Hosting providers commonly give customers access to cPanel rather than direct administrative control of the server. The available features depend on the provider and account permissions. Customers can often view their domains, configure applications and select among PHP versions installed by the server administrator.
For PHP security, the distinction between site-level controls and server-level patching is important. A version selector may change which PHP handler a domain uses, but the customer usually cannot install a new server-wide PHP package or determine the provider's backport policy.
On some systems, cPanel works alongside CloudLinux's PHP Selector or other vendor-specific PHP stacks. Their version labels and update channels can differ from those of standard EasyApache packages.
If you need to confirm a patch, identify the PHP version assigned to the actual domain and ask the host for the vendor package or advisory when the control panel does not show enough detail.