ECS runs the task definition’s image. The CVE is in that image’s PHP, whether the task is on EC2 or Fargate.
Identify the runtime
Describe the service and note the task definition revision and image digest actually deployed. A new revision that was not set as the service’s deployment is not live.
Change and verify
Push a rebuilt image, register a task definition, and update the service. Wait until the old tasks stop. Fargate will not pick up a local apt upgrade. Confirm the new task’s PHP version from a one-off command or from the image build log you trust.
Treat a green health check as proof the process listens. Prove the PHP build separately with the package query or the binary version from inside the new instance. Legacy applications that cannot move off PHP 5.6 or 7.x still need a decision recorded in the pipeline, or the next bake will quietly keep the vulnerable base.
Questions
Does the cloud provider patch PHP inside my image?
Only if that provider manages the runtime. Your image, VM package, or platform stack is the thing to verify.