I'm pretty sure the real threat is unpatched apps, regardless of what language they're written in (which was tomjen3's point). I'm concerned that the relative

I'm pretty sure the real threat is unpatched apps, regardless of what language they're written in (which was tomjen3's point). I'm concerned that the relative complexity of upgrading a Rails app with bundler and application server, webserver, etc is significant compared to the steps to upgrade the average PHP app (copy the new files over the old ones). Then again, perhaps an even bigger threat is people who feel smug about security due to their choice of programming language, which is what you seem to be hinting at.