Thanks for pointing that out. Several years ago, I had a small server running PHP - I had to patch it 3 times in 4 months. It spent more time with patches than I spent rewriting it from scratch.

I just checked the PHP CVEs, amd it seems it has gone quite a while without high scoring CVEs - so, good for them