> Vibe coding a PHP substitute probably takes less time and tears than cleaning up a PHP exploit.

Sarcasm? Definitely not true, by several orders of magnitude. Have you seen how many built-in functions PHP has?

I sincerely try to avoid sarcasm. Communication is hard enough without it.

Just to clarify: I didn't mean the effort to find and fix a vulnerability in PHP (although that is also difficult). I meant the effort to reformat your system, investigate what else was compromised, and recover from backups after you get hacked through an exploit in PHP.

You probably don't use every last function, and you might be underestimating what became possible this year. You could have a model search for the features you use. You could have it loop until your existing code passes with the substitute. You could have it rewrite your code to use fewer features while still passing your existing tests.

I'm not saying you have to do this, but I think we should question which of our old approaches are based on old constraints.