Most notable is a PHP vulnerability that allows complete remote takeover of a website, and somewhere around 70% of the web is running PHP. Much of that won't be patched for a long time, if ever.

Why won't it be patched for a long time?