Rumor says the critical PHP vulnerability being patched today is related to session.upload_progress.enabled, but maintainers say setting it Off (on php.ini, and then restarting fpm) won't be enough, you'll have to update PHP.

PHP 8.2+ are still maintained so they will get the patches. In theory 8.1 on Ubuntu 22.04 is supported by Canonical. Previous versions are all End of Life so it's manual patches and recompile, or upgrade everything to 8.2+