It's always worth thinking about, and the only true "protection" is logging, logging, logging. If you're not reading system logs, you'll never know your daemon

It's always worth thinking about, and the only true "protection" is logging, logging, logging. If you're not reading system logs, you'll never know your daemon was segfaulting for a while, nor will you see that SSH login. Or iptables egress traffic to weird places. Whatever. Point is, knowing what your box is up to, is the only way to meaningfully perform due diligence. My point though, in my prior comment, was attack surface. With PHP you have outdated code in the ORM/MVC/whatever. Then you have your code. At least with only a web server and static HTML, and entire litany, and the most likely part to get compromised, is not there any more. In my 30+ years of experience dealing with people getting compromised, it's always been some asshat not doing security updates (eg, using a distro and updating daily). Or worse, just compiling stuff then not updating builds on a daily or weekly basis. Outside of that, it's been bad PHP code. Or perl. Or whatever. I think once out of all the times I've been called to clean up a mess, has it been the web server itself. Bearing in mind "I didn't update my OS/web server for a year, and now I got hacked!!" isn't "it was the web server", it's "dumbass didn't do security updates". Anyhow. You're not wrong, yes everything is vulnerable. But PHP + framework + PHP code bugs == 9999, web server == 1 of the time.