The most common vulnerabilities are in the frameworks and libraries surrounding a language, not the actual language (there are exceptions). On top of that, user/developer sloppiness is even more common than security bugs in common frameworks. I would bet most servers that get compromised do so through having things like root/password1 credentials or extremely obvious sql injectable code.