Why? How does vulnerability detection for PHP hurt you?

They stated in the comments here that they are actively working on it, and I would personally appreciate it in addition to the number of other static analysis tools I use.

actually, i'm very surprised that PHP isn't in the list seeing how WordPress account for 75%+ of the sites internet and the slew of plugins in its ecosystem.