It depends on whats being hosted. If you&#x27;re dealing with legacy apps that were built in the PHP 5.2 or even PHP 4 days, be afraid. Be very afraid.<p>If you&#x27;re dealing with more mainstream PHP apps like WordPress or Magento, its important to stay up on the core updates but also monitor the plugins and templates being installed. The majority of the attack surface on those apps is in the plugins because they&#x27;re almost never audited.<p>As for modern customer apps, written in frameworks like Laravel or Symfony, you&#x27;re usually fine. Those frameworks are on par with Django and Rails in being very hard to shoot yourself with.