Debian restarts php-fpm when PHP updates, and a reload replaces the workers. But queue workers, supervisord programs and PHP in containers keep the old binary in memory until someone restarts them, and package scanners still report the CVE as fixed.

I hit this patching client servers last week, so I wrote a small open source check that lists PHP processes still running a deleted, pre-upgrade binary and checks the installed version against the vendor’s fix: github.com/asifh0ssain/stillmapped

How are others handling this? Do you restart workers as part of every PHP update, or rely on deploys to do it?