> making sure your own shit doesn't get pwned is a full time job.

Not if you didn't vide code your architecture. I have a 7 year box running without a single incident (touchwood) because 7 years ago we didn't have vibe coding and I used a compiled language. To use PHP for anything serious in 2026 is just insane, let's be honest.