Nginx does not execute PHP by itself. A typical site block uses fastcgi_pass to a Unix socket or a TCP port where PHP-FPM is listening. PHP2Shell is in that PHP-FPM runtime. Replacing the Nginx package and leaving the old pool in place does not remediate the CVEs.
Find the server block that serves the public name, then the fastcgi_pass target. Match that socket to a pool file, usually under /etc/php or /etc/php-fpm.d, and read the user, listen path, and pm settings. The pool’s prefix tells you which PHP build it is. A host can listen on php8.1-fpm.sock and php8.3-fpm.sock at the same time. Only the socket referenced by the vhost is the one your visitors hit.
For CVE-2026-109619, FPM is exposed to the early INI consumer when Nginx sends PHP_VALUE or PHP_ADMIN_VALUE parameters that produce a diagnostic before request initialization. FastCGI parameters you copied from an old guide are worth auditing. Pool configuration loaded at worker start is a different path and is not the same early consumer.
After you install the fixed PHP packages, restart the php-fpm service that owns the socket. Reloading Nginx re-reads Nginx configuration. It does not load a new PHP binary into existing workers. Then request a normal page and confirm the worker process started after the package change.
If the application does not need uploads, a client_max_body_size and a conservative post_max_size reduce some out-of-memory paths. PHP says those limits are not a complete fix. The fix is the patched PHP build behind the socket.
Legacy PHP on Nginx is common in panels that register an old socket next to a new one. The consulting scope includes those 5.6 and 7.x sockets when a simple distro upgrade would point the vhost at a PHP the application cannot run.