Okay PHP has a critical flaw, but, why is your PHP outdated, or so difficult to update? This is an issue I hear about frequently, usually in the form of: “Why are you updating X, didn't we just do that?”. Yes, we just updated X from 20 to 21, and 21 to 22, but, I do that, so I'm on the latest stable and safe release. I have seen this nonsense to often where someone refuses updates, then an issue emerges, and they can't update, since it would break everything. This is also the reason I argue against keeping everything locked on legacy. “It's works so don't touch it”, is the equivalent of, “It works now, until it's too dangerous to keep online, but then we can't update it.”.
I just spent 3+ weeks updating a system, and was told multiple times it didn't need to be done, and I was wasting time and resources. This morning, that project released a major notification of a serious flaw, and we're already on the newer version which is safe. The real problem was never PHP, or Node.js, or X (not Twitter), it was the refusal to update and keep systems updated.