Php vulnerability depends on the rest of your system. E.g. imagine your system has strict sandboxing for PHP.

Also this is like the worst case where the bug is in one monolithic piece of sw. Something like the alpine ssh bug is more relevant, you can plainly see not all systems are effected.