PHP settings, versions and extensions
The PHP settings belong to each website: its own version, its own limits, and which extensions are loaded. None of it needs a shell on the server, and none of it changes any other website.
The version
Per website, not per server.
Open a website and set its PHP version. Several versions are installed side by side, so an old application can stay on the version it was written for while a new one runs on the current release. Each PHP website gets a pool, a Unix identity and a socket of its own, which is what makes that possible: the versions are not sharing a process.
Changing the version restarts that website's PHP. Requests being served at that moment finish; nothing else on the server is affected.
The limits
Memory, uploads and how long a request may take.
The PHP memory limit is the one most applications ask you to raise, and it is a field rather than a file to edit. The limits belong to the website, so raising them for a heavy application does not raise them for a small one sharing the machine.
Scheduled tasks run under these same limits. A task that dies without printing much is often a task that ran out of memory, so raise the limit for the website and read Task output again.
The extensions
Grouped by what you are trying to do.
PHP extensions are listed by purpose rather than as an alphabetical wall of package names, because the question is almost never "do I want imagick" — it is "I need to resize images". Turn on what the application needs and the panel fetches the package and loads it.
Two things follow from how PHP extensions work. Enabling one fetches a package, so it takes a moment and needs the server to reach its package mirror. And PHP restarts to load them, the same brief restart as a version change, because an extension is loaded when the process starts and not while it is running.
An extension is enabled for the website that asked for it. It is not turned on globally, so one customer's requirement does not quietly become every website's attack surface.
What PHP may not do
It cannot run a command.
The runtime is built without the functions that start a program, so PHP cannot run a command on these servers. Applications that shell out to a binary will not work, and that is the intended trade: a website that is broken into is not then a way to run programs on the machine.
If an application genuinely needs a system utility, it belongs on the server rather than inside a hosted website. Most of the time the extension list is the real answer — the thing being shelled out to has a PHP extension that does it in process.