> And yet, I've never succeeded in extracting a straight answer from anyone about why they believe that someone cannot simultaneously have some working knowledge of security and enjoy building PHP applications.

These people are probably thinking: "If you truly knew infosec, you would have moved onto a more advanced language by now."

PHP has a reputation as a "training wheels" language. It's seen as a great starter language to learn the fundamentals of web development, but the expectation is that a "good developer" will eventually migrate to Python/Ruby/Node/whatever once they outgrow PHP.

By staying with PHP, you're signaling that you haven't cleared the bar of being a "good developer" yet.

Is this fair? Hell no. But that's life. My advice? Get familiar with another scripting language. The difference between "I'm a PHP developer" and "I'm a developer that knows Python, PHP, and Javascript" to a lot of people is huge.