CAs guarantee that their certificates are secure. If they find out that is no longer guaranteed, then the guarantee is broken. Guaranteeing security is... well,

CAs guarantee that their certificates are secure. If they find out that is no longer guaranteed, then the guarantee is broken. Guaranteeing security is... well, why CAs exist. And breaking vulnerable PHP servers is probably a good idea anyway. Then maybe someone might realize that they're incorrectly configured.