@paul turns out I had more PHP than I thought I did
Most of it is internal use only so comparatively safe, and those that aren't are either off or blocked from the outside for now.
I really should do a proper #SBOM one of these days - anybody know any good tools?
