php2shell: how are you confirming which PHP your web traffic actually runs on?

Question

PHP's 21 October fixes (8.5.12 / 8.4.27 / 8.3.36 / 8.2.35) cover two critical runtime flaws. Because they sit below the application, updating a CMS or framework doesn't help — the runtime has to change and workers have to restart.

The step I'd expect to trip teams up is inventory. php -v on a shell tells you about the CLI, not necessarily what PHP-FPM, mod_php or a bundled appliance is serving.

What are you using to answer "where does PHP run and is it patched?" — package queries, phpinfo() behind auth, image scanning, something else? And has anyone found a clean way to confirm old FPM workers are gone after the upgrade?

Write-up with versions, interim settings and detection signals: https://dev.to/_firelinks/php2shell-a-request-that-fails-halfway-still-leaves-state-behind-5877