Ubuntu 22.04 ships PHP 8.1. The fix in Ubuntu’s notice is php8.1 8.1.2-1ubuntu2.28, under standard support, USN-8948-1. Upstream PHP 8.1 has no tag newer than the end-of-life line for this CVE. The Ubuntu revision is the vendor backport. A scanner that only understands “versions before 8.2.35” will keep flagging 8.1.2. Answer it with the package changelog, not by installing a third-party 8.2 over the vhost without a test.
apt update && apt install --only-upgrade '?name(^php[0-9.]+$)'
sudo systemctl restart php8.1-fpm
Use apache2 instead of php8.1-fpm when apachectl -M shows the PHP module. The name filter is Ubuntu’s, for the case where a full upgrade is not acceptable. A full apt upgrade is what Ubuntu recommends when it is possible.
Ondrej’s PPA and other extra repositories were not part of Ubuntu’s table. If php8.1-fpm comes from a PPA, Ubuntu’s version string does not apply. Read that PPA’s announcement. PHP’s own note on 21 October said the volunteer Remi RPM repository would not have updates that day. That sentence is about RPMs, not this deb, and it is a reminder to check third-party repos directly.
Jammy systems that added php8.2 or php8.3 from an extra archive have two runtimes. Patch the one the socket uses.