I mean, this isn't a things-made-in-PHP-are-bad problem.

It's a bit more a "certain C programming techniques are bad" problem.

This is more like log4j, heartbleed etc.

Won't be the last of these.