Ubuntu manages most system software through Debian-format packages and APT repositories. A server running Ubuntu can host nginx, Apache, PHP-FPM, databases and applications directly or within containers.
For security response, the Ubuntu release and package source matter. The distribution may supply a security correction as a package revision while keeping the same upstream software version. Separately installed software from third-party repositories or manual builds may have different patch coverage.
A host-level PHP update also does not guarantee that a Docker image or another separately managed PHP installation has changed. The deployed application's actual runtime must be identified before reporting that it is secure.
Record the Ubuntu release, support status, enabled repositories and installed package build. Compare them with Ubuntu's security notice, install the relevant updates and verify the affected services after restart or redeployment.