On a PHP site, each file under the web root can be reached by URL, such as index.php, login.php or upload.php. Frameworks usually funnel everything through one front controller, but many applications and older products expose many scripts, and some of them do significant work before checking who the caller is.
These entry points matter because they are the first code an unauthenticated visitor can reach. If one of them parses a complicated input such as a multipart upload, or calls a library with a memory flaw, then a bug there can be exploited without any account. Vulnerability advisories often name the specific script that is affected.
You can reduce the risk by keeping only the needed scripts in the web root, moving helper files outside it, denying direct access to files that should not be called, and requiring authentication or an allow list for administrative pages.
When an advisory names a PHP file, check whether it is reachable on your servers, and if it is, restrict it while you apply the patch.