When people say PHP isn't secure, I point them to how every release improves security a little bit. PHP 8.6 makes sessions secure by default (check your SSO and payment callbacks before upgrading).
https://www.phparch.com/2026/09/stop-writing-php-like-this-8
