Ubuntu's USN-9055-1 concerns the PHP pecl_http extension. A host can run PHP without loading that extension for a particular site. Identify the PHP runtime handling the web request, then establish where its extension came from. Ubuntu notice
Check the command-line runtime
php -r 'printf("%s %s http=%s\n", PHP_SAPI, PHP_VERSION, phpversion("http") ?: "off");'
php --ini
dpkg-query -W 'php*-http'
PHP calls the extension http. The --ini output identifies the configuration read by the command-line runtime. The package query can help find an Ubuntu-managed package. A manually installed PECL extension or a container image may require inspection through its own build or packaging system.
Check the runtime handling the web request
Use this short check in a restricted diagnostic environment. SAPI describes how PHP is running. For example, PHP-FPM and the cli runtime can read different configurations.
<?php
echo json_encode([
'sapi' => PHP_SAPI,
'php' => PHP_VERSION,
'http' => phpversion('http') ?: null,
], JSON_THROW_ON_ERROR);
A null value means the runtime serving that request did not load the extension. Check each relevant site, worker pool or image separately when the host has more than one runtime.
Use the extension's own update channel
For Ubuntu packages, compare the full package revision with the advisory. For custom images, check the image build's update record. A backported patch can leave the extension's own version string unchanged. After deployment, verify that the intended PHP workers picked up the update and repeat a normal request that uses the extension.