[sanbor]

In 2019, 11% of all vulnerabilities listed by the National Vulnerability Database were linked to PHP; historically, about 30% of all vulnerabilities listed since 1996 in this database are linked to PHP. [1]

Also early this year there were news that git.php.net was compromised and a backdoor was introduced into PHP, but lucky enough the backdoor was catch before a production release.[2][3]

1: https://en.wikipedia.org/wiki/PHP#Security

2: https://arstechnica.com/gadgets/2021/03/hackers-backdoor-php...

3: https://flast101.github.io/php-8.1.0-dev-backdoor-rce/

[heurisko]

I was referring to security issues regarding dependency management.

The git.php.net server was also not compromised, as far as I know, from a PHP vulnerability that was active at the time.