I think there is a subtle, but important thing that the author is missing because, while objectively, PHP as a turing complete language(I believe) you can write

I think there is a subtle, but important thing that the author is missing because, while objectively, PHP as a turing complete language(I believe) you can write basically anything in PHP both good or bad, there is the question of what the language/framework/tools/community allows for or encourages. In the earlier days of PHP, it was incredibly common to build SQL via strings and nobody thought too much about it. Over time things have evolved and a million little frameworks have sprouted up and it's less of a problem, but that doesn't mean that PHP doesn't have a terrible history behind it of a community not knowing or caring as much about security as they should. Then, there is the fact that php files just sit on the server and can be executed arbitrarily by just navigating to that file. That is a real security problem in the case that someone is able to upload a php file to a machine. Yes, I know a lot of frameworks make this harder to do now, but by default apache/php lets you do this and you could argue it's one of the real strengths of PHP(ease of deployment). Last, because PHP is the biggest language it is the biggest target, which means that writing secure code is that much more important. So many PHP projects are open source, so if a vulnerability is found and you don't upgrade your Wordpress or Drupal or Joomla or Magento or phpBB or whatever else app you are running, your site is very likely to be compromised just because you aren't staying up to date with updates, and A LOT of people don't update their software, systems, or packages like they should. So, PHP from a purely objective standpoint might be as secure as anything else, but the human factors surrounding PHP make it a lot worse in my opinion than other languages/platforms/frameworks from a security standpoint.