Heh. I literally search for and report vulnerabilities in my downtime to recharge between development cycles. It doesn't feel like contributing, especially since most of the problems I find can be found via grep. :/
I've had a difficult 2015 as well and your words were definitely encouraging to me! :)
And with PHP, it isn't a sexy language, but a lot of the web still uses it despite the hype on more popular languages and tools.