I was under the impression that this sort of bug is fairly common in both php and common php frameworks?

I thought the real lesson was "assume your web server is compromised if you use php, and try to make sure php doesn't touch anything too critical"