Immutable images are fixed by rebuild and replace, not by a shell session inside a running container.
Identify the runtime
Pin the base image by digest in the Dockerfile after you have read that digest’s PHP version or vendor changelog. Record the digest in the change ticket.
Change and verify
Build in CI, scan the resulting image if you already trust a scanner, and remember scanners that only know upstream version numbers will mis-label Ubuntu and AlmaLinux backports. Deploy by digest. Delete or block the old tag so a later deploy cannot drift back.
Treat a green health check as proof the process listens. Prove the PHP build separately with the package query or the binary version from inside the new instance. Legacy applications that cannot move off PHP 5.6 or 7.x still need a decision recorded in the pipeline, or the next bake will quietly keep the vulnerable base.
Questions
Does the cloud provider patch PHP inside my image?
Only if that provider manages the runtime. Your image, VM package, or platform stack is the thing to verify.