PHP says nothing about 5.x, but both vulnerable paths are in vanilla 5.6.40: zend_mm_safe_error() ends in zend_bailout(), and session.upload_progress.enabled defaults to 1. The fix is sury patch 0261, and the half it deliberately left out arrived the next day in revision 5.6.40-105 as patch 0263.
The official 7.4 backport is one commit, 17 files, +240/-59. For 7.1 to 7.3 the sury patch sets need a prerequisite that patch --dry-run cannot see: ZSTR_MAX_LEN, which the fix references 38 times and which is absent from every vanilla PHP 7.3 and older. Three layers of verification, and the one static marker that works on 7.x.
php:8.2-fpm-bullseye has been frozen at PHP 8.2.29 since 5 August 2025, so --pull on that tag downloads a vulnerable image and reports success. Five measured ways a Docker tag misleads you about the PHP version inside it, and what to use instead on 8.2, 8.4 and EOL 8.0.
The fixed releases 8.2.35, 8.3.36, 8.4.27 and 8.5.12 add one new INI directive, memory_hard_limit_percent, and that is the only static proof a supported build carries the PHP2Shell fix. On 5.6 through 8.1 neither php -v nor php -i changes at all, so the proof is behavioural: an OOM exits 1 with shutdown functions skipped instead of 255 with them running.