I think it's safe to say that 100% of PHP installs have a security vulnerability of some kind, though that doesn't mean the vulnerabilities are known or exploitable.
The myth that PHP has some special bad security profile is completely baseless. It is true that there's a lot of insecure software written in PHP, but the reason has nothing to do with security of PHP as a platform, but rather with its low learning curve, which makes it popular among the same people that make security mistakes - the beginners. They don't make insecure software in Haskell not because Haskell is so secure that you can't write insecure software in it, but because they can't write any software in Haskell at all.
Dropping PHP in this case is a cargo cult - you do not improve your security situation by just mimicking people that made better security decisions in aspects that have nothing to do with security. It's like stopping eating bananas because your neighbor slipped on a banana peel and broke his neck, all while keeping smoking and eating junk food. Replacing negligible risk with another negligible risk while keeping very risky habits would not reduce your overall risk.