And WordPress, drupal and honestly every other php project custom or open source.
PHP needs to go away.
PHP needs to go away.
And from sitting in on a lot of leadership meetings, they're one of the few groups that perpetually seems to be concerned with something they depend on sunsetting.
As long as they're passing with ISO, I just stay out of it.
Php is a go-to route of getting a shell.
And the only reason you see more vulnerabilities for CMS's written in PHP is because the most popular CMS's (Wordpress, Joomla, Drupal) are all written in PHP.
We'd see the same thing happen regardless of the language (except maybe Ada or Rust. They do a good job at stopping you from shooting yourself in the foot).