PHP is already written in C and can be quite secure when following best practices (as with any language), so I'm not sure why an additional PHP extension writte

PHP is already written in C and can be quite secure when following best practices (as with any language), so I'm not sure why an additional PHP extension written in C would be a red flag? Note that Phalcon is a PHP extension (not a C extension) that provides new functionality available in the PHP runtime. This is roughly equivalent to a Ruby gem with a C extension, like Nokogiri.