Maybe that’s because you’ve only worked with WordPress with tons of unpatched plugins.
Every programming language has security vulnerabilities. PHP doesn’t have any more than others.
Every programming language has security vulnerabilities. PHP doesn’t have any more than others.
Yeah it does. Part of it is being a popular starter language before people know what they’re doing, but a lot of it is legitimately terrible language[1] and API design, especially in older versions. It also has CVE-2026-109618, a type of vulnerability many languages aren’t even capable of having (since it wouldn’t be part of the language, and the library that implemented the equivalent would only be present when necessary and usually not written in C - with some exceptions).
[1] People have already covered this in depth, but here’s a lesser-mentioned taste: https://web.archive.org/web/20261017012819/https://www.php.n... (one section, btw)
Unlike well-thought-out languages like JavaScript, of course.
What's the saying? A programming language is either bad, or no one uses it. Discussions about flavors of bad in well-established programming languages are a waste of time.
hell even vanilla xenforo was getting compromised all the time, sure there's smaller frameworks and various government institutions using php, but it has many of the same downfalls that mixing server and client code has, the worst offender that comes to mind that enabled many of these bad practices is next.js