> Probably contrary to common belief here

I don't think that is true. PHP just makes it easy to write anything - including insecure code. And the bigger issue is that the community around PHP often shares code that is insecure without knowing that it is, or why that would be important.

The C argument is a red herring - its not meant for web pages. (web servers, though...)

Rails is not a language. It is a framework. Wordpress has tons of vulns as well.

I agree that "Everything can be a turd in the wrong hands", however, one of the biggest parts of, er, "turd prevention" is the culture and tribal knowledge around a language and best practices. PHP struggles with that because it is so easy to learn and so easy to do something bad.