What harm can the .php virus cause?

Regarding the .php virus, it all comes down to the credentials that that PHP code is running with on the server. If the apache2 process running that PHP code is running as www-root, the damage that this script can do goes to the extent of what www-root can access, which would typically mean all of the /var/www/ folder. To fully understand this question, one needs to understand how linux works, if the web server is running under linux, to fully understand the extent of the possible damage. If it's running under Windows, it would be the same thing, only the damage would be to the extent of what the owner of the process is able to use the machine's resources for.

• Things that typically PHP viruses do are:
  
• Use your server to send spam
  
• Use your server to brute force other servers
  

Use your server's resources to join their own rig and mine crypto-currencies  Those are just a few. They can pretty much use your server to run any software.