It used to be true, and was a valid criticism. It hasn't been true in so long, that claiming so says more about the claimer than the language.
If bashing others' work make you feel cool, then you need to start checking the facts.
My complaint is the inconsistency in the function parameter orders of same categories and the fact it's one of the few languages that still require semi colons at end of lines. Former is pretty much unfixable though unless they introduce same features through new objects.
And the newly introduced typing is just too basic after you've gone through TypeScript but this can be improved.
Not saying that you are wrong here, but what insecure-by-default parts of the language have been changed since PHP 5?