Maybe the author does have a point. There are millions of PHP websites and do we know of any that was pwned?