The PHP disaster has now turned into a clowshow. Some hosters are not updating to the fixed versions of PHP but instead backporting changes to known-bad versions *and not updating the version number*. A hoster I use still says that my site is running 8.4.20, but assures me in a trouble ticket:
"For older PHP versions, the security fixes were applied to the existing release (?backported?) and didn't come with a new version number. If your site, a plugin or a security scanner still reports the same PHP version as before, that's expected, and your site is still protected.”
FWIW, this is a very major WordPress hoster. However, I got a similar story when looking at older versions of Ubuntu: they apparently backported the fixes into PHP versions that are EOL.
The result will be that there will be plenty of systems out there that can’t tell if they are safe, so they will assume they are. And when the next CVE comes out, they can’t even tell what actual version they are coming from.
The blame for this lays squarely on the hosters and repo maintainers, not on the PHP dev team.