PHP-FPM can reload a pool configuration without replacing the process image. For a CVE in the binary, you need the workers to exec the new file. systemctl restart php8.3-fpm, or the unit name you inventoried, does that. It also kills active requests. Warn the application owner and pick a window.
Before the restart, confirm the package is already installed. Restarting first and patching second leaves a gap and a false sense that the restart was the fix.
Afterward, check the master process start time and the log for children that exited with a module error. If the service fails, roll back the package and start the previous build. Do not leave the site down while you debug an extension on a production-only change.
pm.max_requests and a later reload are not a substitute for this restart. They are a way to recycle workers during normal life.
When several versioned units exist, restart only the ones you patched, and do not forget a socket that Nginx still references.