WordPress, shared hosting & managed services
Updating WordPress, Drupal or Joomla does not update the PHP interpreter. Ask the host for the site’s actual PHP handler, full package revision, both CVE references and restart completion. A control-panel branch selector may expose several builds with different patch states. For managed cloud services or appliances, follow the product vendor’s advisory instead of manually replacing a bundled runtime.
Which installations need attention?
PHP advises updating all installations serving Web requests, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed. WordPress, Drupal, Joomla, MediaWiki, Laravel and custom applications inherit the runtime risk. An application update alone does not replace PHP. Inventory embedded appliances, administrative interfaces, staging sites and containers as well as public production websites.
3. Restart and verify every instance
Installing a new binary leaves old worker processes in memory until they exit. Restart Apache for mod_php or the corresponding PHP-FPM services and pools. Restart queue workers and scheduled long-running processes too. Verify service start times, Web runtime version, package revision, health checks and every load-balanced replica. Delete any temporary diagnostic page immediately; do not leave phpinfo() publicly accessible.