On: There isn't an easy exploit for this PHP vulnerability

[abc42]

>PHP is no more vulnerable than those languages.

In theory, perhaps not. In practice, much more vulnerable.

[preg_match → abc42]

Okay but is it though? The PHP language and runtime itself has had practically no exploitable vulnerabilities for the past 10 years.

PHP applications might do suspicious things, by choice. But the runtime itself is fine. Certainly, there are less vulnerabilities in recent years in the PHP runtime than in, say, V8.