> Core run time vulnerabilities in PHP, the language and runtime itself, are rare.

They may be rare today but they have historically been very common.

> To the point where they had to ban java applets from the web.

Those are not RCEs, they were sandbox violations. Sandboxing untrusted code is hard and really only javascript engines have pulled it off. Java and Dotnet gave up, and that's fine.

PHP's security failures are not from trying something ambitious. They're from generating web content on a server. These are not comparable.

Did they learn not to fix overflows by checking a variable for "> PHP_INT_MAX"? That patch was hilarious. But you might have to meet Perl greybeards to understand the fun the internet made of the PHP core devs after that.