OpenBSD purged many webapps from its ports tree one or two releaeses ago for this reason (too many security problems to keep up with). Most such packages didn't

OpenBSD purged many webapps from its ports tree one or two releaeses ago for this reason (too many security problems to keep up with). Most such packages didn't do much else than extracting .php files to somewhere in /var/www anyway. Users of such apps are now expected to do this themselves and keep track of updates.