A Deployment is fixed when the pods that are Ready are running a patched image. Editing the manifest without a rollout leaves the old pods in place.
Identify the runtime
Record the image ID from kubectl get pod -o jsonpath, not only the tag in git. Tags move. Digests do not.
Change and verify
Ship a new digest, wait for the rollout, and confirm old ReplicaSets are scaled down. If PHP-FPM is a sidecar, that sidecar image has to change too. A liveness probe that only checks a TCP port will stay green on a vulnerable binary.
Treat a green health check as proof the process listens. Prove the PHP build separately with the package query or the binary version from inside the new instance. Legacy applications that cannot move off PHP 5.6 or 7.x still need a decision recorded in the pipeline, or the next bake will quietly keep the vulnerable base.
Questions
Does the cloud provider patch PHP inside my image?
Only if that provider manages the runtime. Your image, VM package, or platform stack is the thing to verify.