unattended-upgrades restarted php-fpm at 06:00

Automatic security updates are correct on a server and the restart they trigger is not something anybody scheduled.

# /etc/apt/apt.conf.d/50unattended-upgrades
Unattended-Upgrade::Automatic-Reboot "false";
Unattended-Upgrade::Package-Blacklist {
    "php8.1-fpm";
    "mysql-server";
};

# and needrestart, which is 22.04's default and will
# restart services without asking in non-interactive mode:
# /etc/needrestart/needrestart.conf
$nrconf{restart} = 'l';   # list, do not act

needrestart being enabled by default in 22.04 is the change that catches people upgrading from 20.04 — a package update now restarts every service linked against the updated library, including the database. Listing rather than acting turns it into a report that a person handles during a maintenance window.