Yes, and any exploit is much more likely to be through a vulnerability in the PHP application you are running on the site. That is my experience as a former sys

Yes, and any exploit is much more likely to be through a vulnerability in the PHP application you are running on the site. That is my experience as a former system administrator at a webhost.