Start with the runtime that accepts the public HTTP request. Write down four facts: the CLI version, the FPM or Apache module version, the operating system package version, and whether a vendor advisory calls that package fixed.
CLI
php -v
command -v php
This is the shell binary. Hosting panels and containers often put a different PHP on the web path.
PHP-FPM
The binary name varies. Look at the running process, then ask that binary for its version.
ps -eo args | grep -E '[p]hp-fpm'
php-fpm8.3 -v
Replace php-fpm8.3 with the binary you found. Repeat for every pool if the server hosts more than one version. A reload is not proof that old workers exited. Prefer a restart when you are validating a security update, and expect in-flight requests to fail during that restart.
Apache module
apachectl -M | grep -E 'php|mpm_'
On RHEL-family systems the command is often httpd -M. You want to know whether php_module is loaded and whether the MPM is prefork. mod_php is the combination PHP highlights.
Packages
On Debian and Ubuntu:
apt list '?installed ?name(^php[0-9.]+$)'
That pattern is from Ubuntu’s php2shell post. Compare the full package version with USN-8948 or the Debian security tracker, not with the upstream number alone.
On AlmaLinux, AlmaLinux’s post says to use rpm -q php-common, or rpm -q php8.4-common for the 8.4 packages on AlmaLinux 10, because backports may leave php -v unchanged.
Decision
If the web binary is an upstream build at or above 8.2.35, 8.3.36, 8.4.27, or 8.5.12, you are in the fixed upstream range for that branch. If it is a distribution package, open the vendor advisory even when the upstream number looks old or new. Then restart and check again.
Questions
Is php -v enough?
No. It reports the CLI binary on your PATH. The vhost may use a different build.