PHP is a perfectly fine language. It’s memory-safe, garbage collected, and high-level. It’s just as reasonable of a choice as C# or Java.
The PHP runtime has had very little vulnerabilities. Much less than Node.