You don't have to use PHP for your website
There are better alternatives. Look into ocsigen which is designed by computer scientists understanding something about cybersecurity, and into haxe. Of course you'll spend months to learn it, and if you choose to use ocsigen you are taking some commercial risk (the people and companies maintaining it could disappear, so called bus factor). But I personally know the main architect and designer of Ocsigen, and I can ensure you he understands quite a bit about cybersecurity (half of his PhD thesis is on that topic).
I have to either use it or nothing.
No, that is wrong. You don't have to use PHP. For example, read this blog about building your website in C++, and that one about web technologies in Common Lisp. You could use other approaches (e.g. FastCGI servers written in C++ or in Go, your specialized HTTP server written in C++ e.g. with libonion or with pistache or with CppCMS or Wt, in Go, in Common Lisp with SBCL). With Rocket.rs you could write web applications in Rust (and the Rust community cares a lot about cybersecurity). You can program dynamic web servers in SML. And many web servers (Apache, Lighttpd, ...) can be customized or adapted to your needs (e.g. with your plugins written by you for them) without a single bit of PHP related thing.
My biased opinion is that web frameworks above Common Lisp or C++ or Go or Rust are usually designed by educated computer scientists who by profession understand and care about cybersecurity. PHP was designed with a completely different mindset: being able to code dynamic websites quickly. At the time PHP was designed (1995), cybersecurity was not a major concern, but being able to make a nice looking dynamic website in a few days was in practice essential.
But whatever you are using, it does has some cost. Read about externalities. Read J.Tirole's academic work on them (he is a Nobel prize of Economics; his paper on simple economics of open source is worth reading, and the most cited on that topic). Even if it is free software (since free software is about freedom, not budget). At least don't forget the cost of your efforts to learn it and evaluate its cybersecurity aspects.
If you use open source libraries, they still have some cost for you: you need to learn them, to assess them. They usually are given WITHOUT WARRANTY. But you can buy support for these libraries.
If you use proprietary libraries or software components, you are bound by their EULA.
Security is always a matter of trade-offs.
You are able to not fasten your seat belt when driving, but then you take an additional risk and you pay for that (e.g. because your insurance won't cover you if something goes wrong, or because you get some fine). It is the same for software choices.
Be however aware of Rice's theorem. In some ways, it tells that full cybersecurity is impossible. But even living is a risky activity. (You or me could have a heart attack in a few hours).
Your problem is non-technical, but social. If you use open source software, you have the ability to study each source code line and be convinced (or not) that the security is good enough. Of course, that could take decades (or centuries: an entire Linux distribution is now 20 billions lines of source code). But the choice is yours (and you can delegate the security assessment of every software component you are using).