When maintainers fix a vulnerability in a current release, the change may depend on code that does not exist in an older branch. A backport takes the necessary correction, adjusts it to the older design and tests whether it works without pulling in unrelated features.
A source backport can be distributed as a patch file or a commit and then built into a package. It is not the same as an installed security update: someone must apply it, rebuild the software, test it and deploy the resulting binary before it can protect a running service.
That distinction matters for unsupported PHP branches or custom builds. A published patch may offer a technical route for experienced maintainers, but it does not create a new official supported release or guarantee that a host has installed the correction.
Track the exact commit or patch, the source revision, build options and validation results. Prefer vendor-maintained packages when they are available, since manual backports create an ongoing maintenance obligation.