proxy_fcgi is an Apache proxy to a FastCGI server. For PHP, that server is usually PHP-FPM on a Unix socket or a TCP address. The proxy is not the memory manager described in the advisories.
Write down every ProxyPass and FilesMatch handler. A TCP backend on 127.0.0.1 is still local. A TCP backend on another address is a different machine, and the package update has to happen there. A Unix socket is local, and the socket’s owning service is the restart target.
SELinux or AppArmor can allow Apache to connect to the socket while blocking a newer socket path after you switch versions. If the site returns 503 after a deliberate socket change, check the denial log before you roll the PHP package back. A connection failure is not evidence the CVE is fixed.
Pass-through of request bodies matters for the out-of-memory issue. Limits you set only inside PHP can be too late if a huge body is already accepted. A LimitRequestBody in Apache is a frontend control PHP recommends in spirit when it tells operators to enforce decoded size at the frontend. It remains a temporary reduction.
Validate by requesting a PHP page and checking the FPM access or slow log timestamp against the service start time. The proxy’s access log shows Apache is up. It does not show which libphp the worker mapped.