Yeah, quite weird. PHP as a webserver has a large amount of known language design things which decreased security (most have been removed over the years afaik), but for scripting? I can't think why it's particularly insecure compared to Python or Perl.