Elastic Beanstalk platforms include a PHP runtime. Your application zip does not replace that platform PHP.
Identify the runtime
In the environment, record the platform branch and the PHP version the platform documents. A custom AMI or an .ebextensions package can overlay another PHP. Find that overlay.
Change and verify
Move to a platform version AWS marks as containing the fixed PHP, or replace the overlay with a fixed build. Rolling updates replace instances. Watch instance health and keep the previous platform version available for a rollback. Do not invent an AWS platform version here. Read the Elastic Beanstalk release notes.
Treat a green health check as proof the process listens. Prove the PHP build separately with the package query or the binary version from inside the new instance. Legacy applications that cannot move off PHP 5.6 or 7.x still need a decision recorded in the pipeline, or the next bake will quietly keep the vulnerable base.
Questions
Does the cloud provider patch PHP inside my image?
Only if that provider manages the runtime. Your image, VM package, or platform stack is the thing to verify.