A backport copies the security fix onto the distributor’s older PHP and keeps their version numbering. PHP warned users to check vendors for that reason. Proof is the vendor’s fixed version, not a mental comparison with 8.3.36.

Steps:

  1. Open the advisory for your distribution and these two CVE IDs.
  2. Find the source package and the fixed version for your release.
  3. Query the installed package. apt-cache policy or rpm -q.
  4. If the installed version is older than the advisory, update. If it is equal or newer and the vendor has not withdrawn it, record the match.
  5. Restart the SAPI and query again. A cached package database is not a running worker.

Ubuntu 24.04’s 8.3.6-0ubuntu0.24.04.13 and AlmaLinux builds that still print 8.2.33 or 8.3.33 are examples from their own posts. Do not generalize those strings to other releases.

If the vendor has no row for your release, the honest status is “not confirmed”, which is what several guides on this site say. Do not fill the gap with a version from a different distribution.

Sources checked