I agree, but this affects far more than PHP. There are a LOT of projects that use environment variables for secret credentials, and it's especially scary because a number of tools love dumping environment variables.

I'd much prefer pulling credentials from a file or pulling down credentials based on properties that the application is oblivious to. There's risks to using files too, but in my experience, environment variables are used a bit more carelessly.