You patched PHP. But did you patch every copy?
Topic
You can’t manage what you can’t see. Before software can be installed, compliance assessed, inventory gathered, or patches installed, a system has to be known and managed.