In this day and age, you'd use a framework like Laravel or CakePHP, which are a joy to work in. And the only reason you see more vulnerabilities for CMS's writ

In this day and age, you'd use a framework like Laravel or CakePHP, which are a joy to work in. And the only reason you see more vulnerabilities for CMS's written in PHP is because the most popular CMS's (Wordpress, Joomla, Drupal) are all written in PHP. We'd see the same thing happen regardless of the language (except maybe Ada or Rust. They do a good job at stopping you from shooting yourself in the foot).