Compose starts the services in your file. PHP2Shell is fixed only if the image those services run has been rebuilt or retagged to a fixed build.
Identify the runtime
Check every service that mounts PHP code. A php and a queue worker can share an image or use two images. Read image: and build: for both.
Change and verify
Build, then up -d so the containers are recreated. compose restart keeps the old container filesystem. Confirm with docker compose ps and the version command inside the new container ID.
Treat a green health check as proof the process listens. Prove the PHP build separately with the package query or the binary version from inside the new instance. Legacy applications that cannot move off PHP 5.6 or 7.x still need a decision recorded in the pipeline, or the next bake will quietly keep the vulnerable base.
Questions
Does the cloud provider patch PHP inside my image?
Only if that provider manages the runtime. Your image, VM package, or platform stack is the thing to verify.