Don't use this as a reason to diss PHP. Almost any target, no matter what language, is vulnerable.