Take the hostname users type. Resolve which load balancer or server accepts it. On that server, open the vhost for that name. Follow the FastCGI socket, proxy, or PHP module. You now have a process and a binary.
Repeat for API hostnames, staging hostnames that were left public, and www versus apex if they differ. Check IPv6 vhosts if you have them. A forgotten server block is a common miss.
Containers need the same walk from the ingress to the pod. Panels need the walk from the domain’s PHP selector to the binary under the panel prefix.
Write a table: hostname, server, socket or module, binary version, package version, exposed or internal. Patch the exposed rows first. Internal rows still matter if an attacker who lands elsewhere can reach them, and they are second in the same week rather than optional.