PHP2Shell: why php -v can't tell you if you're patched

Distro backports keep old PHP version numbers. How to really check for CVE-2026-109618/109619, and what NGINX can and can't do.