A hosting provider divides a physical server into virtual machines, each with its own allocated resources, operating system and administrator access. A VPS offers more control than basic shared hosting without requiring an entire dedicated machine. Isolation depends on the hypervisor and provider configuration.
With an unmanaged VPS, the customer normally maintains the guest operating system, runtime packages, firewall, web server and backups. A managed VPS shifts some of those tasks to the provider, but not necessarily responsibility for application dependencies or custom-built PHP binaries.
Security exposure follows what actually runs inside the guest. Updating the physical host or the hypervisor does not automatically replace a vulnerable PHP process in the VM. Conversely, patching the guest cannot correct an unresolved vulnerability in the virtualization layer.
Maintain an inventory of both infrastructure and application software, apply guest updates, restart affected services, monitor resource limits and test recovery from a separate backup.