Vanilla PHP isn’t any “safer” in this regard. There’s lots of old PHP code out there that stopped working when PHP 7 removed a bunch of old, long-deprecated legacy cruft. That was good for the platform overall, but if you wrote a vanilla PHP app in 2008 and haven’t touched it since, odds are it complicated your life.

TFA is asking for a platform that never moves. The problem is that the only platforms that never move are ones that have died.

That's a good point. You need a language that doesn't move and always remains backwards compatiable. But I presume C is not a great choice as it's too low level.

I think JS will have this property for a long time, because of it's browser ties. And Haskell is another language I think won't change dramatically if you use the fundimentals. However in both cases you will want to roll your own web framework or at least pin to one you like, ideally something minimal.

However it does raise the problem of security patching, or lack of if you go down such a route.

The other mitigation, which you can do in any language is Inversion of Control. Have your code specify what sort of things it needs rather than use hard dependencies. E.g. "I need something that takes a string and a function and routes it" rather than "I need Express.js", with a layer that maps this up to actual implementations.

This way if frameworks change the mapping layer should be all that needs to change. Again pick a language like JS, Haskell, probably C#/Java etc. that is likely to be backwards compatiable for a few years to come.