> We all deep down know that PHP is insecure

Do we? This was certainly true years ago. But I haven't really thought that modern PHP was any worse than any other scripting language.