Comment by redox99

As long as PHP is written in C, it will be insecure.

It sounds cliche but yes, they should rewrite PHP in rust or other memory safe language.