Despite the fact we have grown accustomed to multiple vendors selling us stuff which will detect bad things, it is surprisingly difficult to do and limited in its abilities. While malware detection continues to have its place, a better approach, particularly for hosts acting as servers, is to use white-listing - i.e. identify the stuff which is supposed to be there and report any changes.
This is done with intrusion detection systems. The simplest of these maintain a database of file hashes and check for changes. In the case of a single VPS running PHP + webserver you should at least be monitoring:
- the webserver and php config
- the PHP executable and extensions
- any .php files (and other extensions you use for PHP scripts in your document root and include path
- /bin/, /usr/bin/, /sbin/, /usr/sbin/, /usr/local/bin/, /usr/local/sbin/
Of course, when you run a patching cycle or a code deployment you are going to see lots of alerts unless you re-baseline the file hashes after the exercise.
Make sure you have provisioned a mechanism to get alerts off the target ASAP.
There are lots of other things you can do to ensure the security/integrity of the host, but file checking is an easy and effective mechanism.