Comment by Good4boothee

I mean no language is immune to issues. Java world constantly sees fixes for both JVM and libraries. For example, besides famous log4shell, you can see still see in HTTP access log that bots are checking for vulnerable Struts versions. On the other hand, Java pushed to 100% Java (no native code) database drivers, while PHP strongly relies on c/c++ extensions, cause PHP is/was too slow. If there is any other difference, I think it just comes to legacy PHP approach - memory management didn't matter if entire request (and forked process that handles it) was alive for maximum few seconds.