A managed VPS splits responsibility. The provider may own the OS packages while you own the application and sometimes a panel.
What to look at
Ask which party restarts PHP-FPM and who approves a version change. Inventory crons and queue workers that call a full path to php. Those paths survive an OS update that only changes /usr/bin/php.
Remediation
Write the change window, the rollback package, and the health check into the provider ticket. If they only update the default module and you run three extra versions from a panel, list those versions in the same ticket. Legacy managed servers on PHP 5.6 need an explicit decision, not a silent default upgrade that takes the site down.
Nginx or Apache in front of Managed VPS hosting is still only the proxy or the module loader. Follow the web server guide that matches the handler you found. Temporary PHP settings remain incomplete if the provider cannot patch this week. CISA’s 21 October 2026 alert said internet-facing PHP that cannot be updated should be taken offline until it can. That is a business decision for a store or a campus site, and it is the alternative to pretending the application update was enough.
Questions
Does updating Managed VPS hosting fix PHP2Shell?
No. Managed VPS hosting runs on PHP. The PHP binary or package that serves it has to be patched or replaced.