@philipnorton42 > Because moving everything to a different platform is so easy for everyone!
It doesn't have to be "easy for everyone" to be a good advice.
It can be a decision for a longer roadmap, like how Nextcloud is slowly porting critical parts to rust or how wikimedia has more and more services in go or python.
Or it can be a decision that is easy for many, even if not for everyone. Do you really need Wordpress, or is a hugo or ghost setup an option for you?
Or, it can be a decision that's made on attributes that weigh pros and cons, this incident being yet another "con" for PHP, getting closer to a tipping point for you or your organization.
And "major" is a semantic argument, but https://github.com/php/php-src/security/advisories/GHSA-62xp-839h-2637 was less than a month ago, was "medium". There's been almost one such CVE every month. (And yes, the main python runtime is similar in that sense, as is the cRuby runtime) So to say there are no incidents is stretching it.
Aside from how it's easy to write insecure applications in PHP, by using the "wrong" system apis or using them wrong. Like how rand() and mt_rand() have been insecure like forever.
> In 2019, 11% of all vulnerabilities listed by the National Vulnerability Database were linked to PHP - https://en.wikipedia.org/wiki/PHP#Security
Which isn't to say that the PHP runtime is insecure, but that the ecosystem has a tendency to build insecure applications. Far more than e.g. rust, go, or even pythons', where it's harder to introduce vulnarabilities or easier to write secure applications. Where the language, runtime and above all, the community/ecosystem has a habit of care for security. Rust and Go have security in their DNA even.
