Pods run application workloads on cluster nodes. A web service may have several Pods behind a Kubernetes Service, and a Deployment can manage replacing those Pods when a new container image is released.
For patching, the container image inside each Pod matters. Updating a cluster node does not by itself update PHP packaged in an application image. Restarting a Pod with the same vulnerable image does not correct the image contents either.
Rolling deployments replace Pods gradually, so old and new replicas may coexist for a time. A rollback can restore an older image if the release record or deployment policy is not managed carefully.
When verifying a security fix, inspect the image digests in the running Pods, not just the declared image tag. Check that the rollout completed successfully, no old replicas remain and the service health checks pass.