Maybe it's not the language, maybe it's all correlation and no causation, but software that happens to have been written in PHP does not have a stellar security

Maybe it's not the language, maybe it's all correlation and no causation, but software that happens to have been written in PHP does not have a stellar security track record. My logs don't fill up with lines like: HTTP POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php for no reason whatsoever.