I remember our infosec person instructing us to verify we don't use log4j in our system written in PHP. Well, we didn't :)