My teammate Matt Green put together a new Velociraptor artifact to "inventory PHP installations on Windows, Linux and macOS for remediation scoping. Collect package versions, common binary/module paths and running PHP processes."
https://docs.velociraptor.app/exchange/artifacts/pages/phpinventory/
This might come in handy in the upcoming days 🙈