A reverse proxy in front of PHP does not contain the bug unless it is also the PHP process. It does decide which origin is exposed, and it can enforce request size.
Identify the runtime
Draw the path from the public name to the origin pool. Include CDN origins, internal load balancers, and blue/green backends. A patched green stack is irrelevant while the balancer still prefers blue.
Change and verify
Shift traffic only after the origin’s PHP is verified. Body-size limits at the proxy support PHP’s advice to bound requests at the frontend. They are temporary. The origin binary still has to change.
Treat a green health check as proof the process listens. Prove the PHP build separately with the package query or the binary version from inside the new instance. Legacy applications that cannot move off PHP 5.6 or 7.x still need a decision recorded in the pipeline, or the next bake will quietly keep the vulnerable base.
Questions
Does the cloud provider patch PHP inside my image?
Only if that provider manages the runtime. Your image, VM package, or platform stack is the thing to verify.