How do you find every system that runs PHP?

You find them in two passes. First list everything the internet can reach, then look inside your network for anything that serves a web page. The second pass matters, because PHP sits in more places than a web server you manage yourself: content management systems, monitoring tools, webmail and the web interface of network devices. On 21 October 2026 the NCSC advised treating every internet-facing system that runs PHP as vulnerable until it is patched.