Is what you host publicly accesible? If not, then it’s not even a concern. You could even host unsafe apps, but if you know they are entirely inaccessible, it wouldn’t change a thing.
As for php itself, it’s mostly due to the fact it’s by far and wide overwhelmingly crushing the competition. A quick Google search says it’s used by about 80% of websites. So, it has, by far, the most (negative) publicity, biggest target, and most inexperienced/bad devs working on it. Software is as secure as its made. Junior dev don’t often think about security. It’s bigger, so it happens more often.
We had to do similarly for one of our cats. Grab the cat. Bend the head up. It will practically force the mouth open. Shove the pill deep into it. Close the mouth.
At least, at some point she learned to give up and stop resisting so damn hard every time.