Score each runtime, not each website brand.
Highest urgency: internet-facing mod_php, because PHP demonstrated pre-application exploitation there.
Next: internet-facing PHP-FPM, CGI, FrankenPHP, and LiteSpeed. FPM is not safe. It is a different evidence level.
Then: the same SAPIs on networks an attacker would reach after a foothold.
Lower the score only when the runtime is already on a fixed upstream release or a package you matched to a vendor advisory, and the workers have been restarted. Unknown package status stays high.
Data sensitivity changes the containment choice. CISA’s offline recommendation fits a system you cannot patch that holds data you cannot expose. A brochure site and a payment site do not share that cost, and both are still bugs.
Write the ranking down. Patch in that order. Reassess when a vendor ships a package you were waiting on. Do not leave the list in a chat scroll.