OpenLiteSpeed serves PHP through an external application, commonly an lsphp binary configured in the WebAdmin console. The PHP advisories discuss LSAPI behavior and do not publish a separate OpenLiteSpeed package version. This page does not invent one.
Open the external app for the virtual host and copy the command. That path is the runtime. If you installed lsphp from a LiteSpeed repository, the fix has to come from that repository’s announcement. If you compiled it, you are in the source-build case: only the four tagged upstream releases, or the published 7.4, 8.0, and 8.1 backport branches, are upstream artifacts this site will name.
After replacing the binary, gracefully restart OpenLiteSpeed and confirm the external app’s process start time. A cached opcode file is not the CVE. The mapped PHP binary is.
Per-directory php.ini overrides still matter for the stale-state issue if they inject diagnostics early. Remove obsolete flags after you can read the error log, and do not treat a quiet log as a patched binary.
Until the vendor or your rebuild is in place, the temporary PHP settings in the mitigations guide apply to this SAPI as configuration, with the same warning that they are incomplete.