I'm not sure it's that cut and dry. For one thing, PHP itself has vulnerabilities, as do its flagship apps. These vulnerabilities are easy to scan for, because

I'm not sure it's that cut and dry. For one thing, PHP itself has vulnerabilities, as do its flagship apps. These vulnerabilities are easy to scan for, because the default configuration advertises that it is there and what version it is. If you're worried about some kid running scripts or idly scanning, you're probably in better shape with a custom C program than with a widely-used PHP program, even though the custom C program is likely to be more fragile and crumple more easily under actual expert attention.