PHP is not inherently insecure—but some deprecated and now removed or disabled-by-default features were in the past. It all depends on the way apps are develope

PHP is not inherently insecure—but some deprecated and now removed or disabled-by-default features were in the past. It all depends on the way apps are developed on it. You can create web apps with security vulnerabilities in any language/framework you use, whether it's PHP, Python, node.js or anything else. Regarding scaling, node.js is probably faster because of the JIT compiler, but this doesn't mean that scaling is not possible. Wikipedia is PHP, Wordpress is PHP, and Facebook is also PHP (with HHVM).