For teams still working through the patching, the practical first step is an inventory of which internet-facing hosts and containers actually run an affected PHP version, since that list is often incomplete. Patching also does not remove anything already planted, so on exposed hosts it is worth checking web roots and upload directories for new or modified PHP files and reviewing access logs from before the patch date. Honeypot data showing few successful attempts is a useful trend signal, but it says little about whether your own servers were hit.