When a visitor opens a PHP-powered page, a web server or proxy sends the work to a PHP handler. Common arrangements include PHP-FPM behind nginx or Apache, and PHP handlers managed by a hosting control panel. That handler is the web-serving PHP environment.
Its version, loaded extensions and configuration can differ from the PHP command that runs in a shell. Different domains may also use different PHP handlers, so even two sites on one server can have different patch status.
For vulnerability response, the web-facing environment is the one exposed to remote HTTP requests. Checking only a package listing or a CLI banner can miss an older pool still processing traffic.
Identify the domain and its configured handler, inspect the active web runtime through a trusted administrative method, and verify that its running workers were replaced after the patch. Avoid leaving public diagnostic pages on the site.