We have been hosting our Wordpress blog on a Linux virtual box, and our main web application on an IIS server. Our website is www.mainsite.com and the wordpress is on www.blog.mainsite.com.
Now there is a requirement that the blog appears as www.mainsite.com/blog. I can install PHP, MySQL and Wordpress on our main website IIS server; my question is if there are any security and performance concerns? Every now and then, a new vulnerability is found in Wordpress and PHP; Is it fine to bring such vulnerable technologies to our main web server? Can someone tell "if the admin account of the wordpress blog gets compromised, can this cause any issues for the main web application?"
and if it is a bad idea to bring a new stack of technology to our main IIS web server, how can we achieve www.mainsite.com/blog instead of current www.blog.mainsite.com?