A PHP Security Rule Blocked My ColdFusion Logins — Then I Found 4,500 PHP Files on the Server

Is PHP Running on Your ColdFusion Server? How to Check, and Remove It

After a host's blanket PHP2Shell mitigation blocked every multipart form on his ColdFusion sites, the author went looking for PHP on a server that was never supposed to run it. He found a forgotten phpMyAdmin install with about 4,500 files, one copy exposed at the bare IP. He walks through PowerShell checks for IIS handler mappings, stray .php files, and running processes, then a reversible removal: back up IIS config, move the app, deny .php extensions, drop the handler, uninstall last.