It’s Not the Stack, Its the upkeep!

After 20 years of being in IT and tech, I have been humbled by how vast the field of technology is. I often use doctors as an example. An expert cardiologist is a doctor, but so is a dentist; both are required, and neither can do the other’s job. In IT and tech it’s similar, and to look down on other tech stacks is to be ignorant.

A couple of days back, I was in a group meeting about animal rights, and a “so-called” tech expert in that group very confidently said that the PHP, LAMP and WordPress stack is pathetic, hackable and not to be used. I didn’t intervene or speak against it because I was not there to start arguments, but I felt that it makes sense to clarify why that is not only wrong but highly ill-informed.

Used the most, so hacked the most

The LAMP stack is used the most around the world. It’s open source, very easy to learn and extremely secure. The reason it gets hacked the most is the same reason it’s used the most: the high number of websites and web apps out there. It’s sheer numbers. Most of these sites have been made by people or companies who have done a shoddy job, either due to inefficient programming or simply because they were not paid well, as most clients refuse to pay properly.

It’s not a small player either. PHP runs about 69% of all websites where the server-side language is known. Wikipedia runs on PHP, and Facebook was built on PHP. If it were pathetic and hackable by nature, these would not be built on it.

Websites require maintenance: plugins need to be updated, sites need to be updated, code needs to be updated, and with cheaply made websites none of that takes place. Hackers find insecure sites and hack them, and the tech stack gets tagged as insecure.

WordPress itself is rarely the problem

In 2022, Patchstack found that about 93% of reported WordPress security bugs were in plugins, 6.7% in themes, and only 0.6% in WordPress core. So the weak point is usually a badly made or outdated plugin, not the platform.

WordPress has a dedicated security team, and since version 3.7 it updates itself automatically for security releases. Being open source also means thousands of developers around the world are looking at the code, so problems get found and fixed fast.

Modern PHP is not the PHP of 2005

PHP 8 has built-in secure password hashing, and prepared statements protect against SQL injection, which is one of the most common attacks. Used properly, these close the doors most hackers walk through.

PHP2Shell: a real scare, and how it was handled

And yes, PHP had a real scare recently. In October 2026, a serious bug called PHP2Shell was found in PHP’s core engine, affecting versions all the way back to PHP 5.4. What’s interesting is how it was found: security researchers used AI to go through PHP’s source code and dig it out.

But look at what happened next. The bug was reported to the PHP security team in August, and they worked with the researchers on a fix. On 21 October, patched versions of PHP were released the same day the bug was made public. Hosting platforms like cPanel and CloudLinux pushed fixes for older PHP versions, and companies like Cloudflare put temporary protections in place for servers that couldn’t update straight away.

Most importantly, the fix was on the server. Website owners didn’t have to change a single line of their WordPress site. Their host or developer just had to update PHP. Sites with a good host or someone maintaining them were patched quickly. The ones left at risk were, once again, the ones nobody was looking after.

Every tech stack has bugs. What matters is how fast they are found and fixed, and whether someone is there to apply the fix.

What a secure LAMP site needs

A properly built LAMP site is secure: core, themes and plugins kept updated, only a few well-maintained plugins used, strong passwords with two-factor login, correct file permissions, HTTPS, a firewall, regular backups and good hosting. None of this is expensive. It just needs someone who knows what they’re doing and a client who values maintenance.

No tech stack is unhackable. Sites built on the newest frameworks get hacked too when they are badly built or left unmaintained. Security comes from the people who build and maintain the site, not the logo on the stack.

Also Posted on LinkedIN : https://lnkd.in/p/g92fDyDN