I also maintain a language filter over at selfh.st/apps that can be used to identify PHP-heavy platforms:

https://selfh.st/apps/?language=PHP

That list isn't completely accurate for what you're after. My project, for instance, is not on the PHP list despite it being written in PHP because the platform is Docker. The selfh.st filter as described by eshol might be the better way to go.

None of my stuff is publicly accessible so yay for not having to take anything offline.

There are quite a few things offline in NL because of this though.

My Nextcloud is the only public facing service on the list. Is it sufficient to just disable public access via Nginx Proxy Manager and continue to permit local access for Nextcloud, or do I need to just shut down Nextcloud until it gets updated?

https://awesome-selfhosted.net/platforms/php.html

The good thing about it is that all PHP applications run through a single service (unless you use containers for each of them individually, I guess), so it's really easy to take them all down at the same time, and update them all at once.

Roundcube and Baikal for me. I used Mutt for email today 😂

Synology includes some php runtime or package they require... I think... But I dont expose my services outside.

Isn’t zabbix missing ? Just from the top of my mind

Browsing through the list... ok how do I tell if my server has been compromised, because I run a fuckload of those...

Phew, nextcloud and freshrss both have updates to resolve the vulnerability. Furiously logs in to update