Caddy does not contain the PHP engine unless you are running FrankenPHP, which has its own guide. The common php_fastcgi snippet dials a PHP-FPM socket such as unix//run/php/php-fpm.sock or 127.0.0.1:9000.
Read the Caddyfile, find php_fastcgi, and resolve the socket to a pool the same way you would for Nginx. Install the fixed PHP for that pool. Restart php-fpm. Caddy can keep proxying through the restart if the socket returns. You do not need a Caddy upgrade to load the new PHP, and a Caddy upgrade will not load it for you.
If the socket is shared by several sites, one restart covers them. If a second php_fastcgi line points at an old versioned socket, that second pool is a separate patch.
Frontend body limits in Caddy are useful alongside post_max_size. They are part of exposure reduction. The complete fix remains the FPM package named by PHP or by your distribution.
FrankenPHP users should leave this page and follow the FrankenPHP guide, because that binary embeds PHP and the restart target is different.