Some of the problems with PHP are things that are problematic or irritating to development (e.g. its inconsistent standard library) but other things are actively dangerous to security and correctness. For example, in PHP, '9223372036854775807' == '9223372036854775808' returns true.[1] Now imagine those two strings are hashed passwords.

The overall problem is not with specific flaws of PHP; the problem is that flaws in a language lead to errors in programs written with that language, and when that languages is used to write some kind of web infrastructure, then use of that language by people less than experts (i.e. almost everyone) is harmful to the whole internet. PHP can be used to write useful, scalable, secure web apps in the hands of someone who knows what they're doing, but in the hands of someone who doesn't quite know what they're doing, or who does but is tired enough to miss individual details of their code, it is much more dangerous than other comparable languages.

That is why I discourage the use of PHP if possible.

[1]: https://bugs.php.net/bug.php?id=54547 (Both strings appear numeric, so they are casted to numbers before the comparison, but because they are larger than maxint, they are rounded down. The solution, if you really must use PHP, is to use === instead. The fact that a solution exists does not mitigate my concern.)