Fun fact:
Over 50,000 procedural PHP5 files under zero revision control, without a non-production environment to test on, power one of the largest "grey area" e-commerce platforms currently online. The type of place where you can resell medical pills which claim to cure every illness under the sun.
"index_old_test1.php" etc. was normal and the codebase went back to 2005.
It runs (unless things have changed... which is unlikely) on 3 physical servers - HAProxy, Apache2 and MySQL5.
No backup or failover/redundancy.
Oh, and more PII / GDPR data than you can shake a stick at - unencrypted at rest and in transit between app & database servers.
Everyone shared the same root password (no SSH keys!) with boxes listening on 22 via public IPs.
Thankfully the contract was a short albeit terrifying experience.
Never seen anything so bad in nearly 20yrs of tech.