The customer can typically control the operating system, networking and software stack, subject to the hosting contract. Dedicated hardware can offer predictable capacity and customization, but does not automatically make a deployment more secure.
Management responsibility depends on whether the service is managed or self-managed. A hardware provider may replace failed components while the customer remains responsible for updating PHP, nginx, the operating system and applications.
A dedicated server can still run many virtual machines, containers and PHP installations. A single command at the host level may inspect only one of them. Vulnerable software can remain in an old image or a secondary site even after the primary runtime is patched.
Map the actual workloads, identify who supplies and maintains each package, apply vendor updates and verify every exposed runtime. Include backup, recovery and access-control procedures in the maintenance plan.