The best thing they can do to strengthen security would be to sunset PHP.

There's no need for that many web languages, programming language is not a relevant factor anymore and even it was nobody can seriously argue that writing PHP "makes their heart sing" or some shit.