Azure App Service, virtual machines, and AKS do not share one PHP. The fix follows the product that starts the process.
Identify the runtime
For a VM, use the OS guide. For App Service, read the stack version in the portal and Microsoft’s update for that stack. For AKS, use the Kubernetes image process. This review did not confirm a Microsoft build number.
Change and verify
Apply the vendor’s stack update or roll the container. Restart the app so old workers exit. A deployment slot swap only helps if the slot you swap in is already on the fixed stack.
Treat a green health check as proof the process listens. Prove the PHP build separately with the package query or the binary version from inside the new instance. Legacy applications that cannot move off PHP 5.6 or 7.x still need a decision recorded in the pipeline, or the next bake will quietly keep the vulnerable base.
Questions
Does the cloud provider patch PHP inside my image?
Only if that provider manages the runtime. Your image, VM package, or platform stack is the thing to verify.