"People should not expect PHP to be able to enforce security boundaries on a developer that has permissions to run custom PHP code," Gutmans said. "It's an inherently flawed scenario — and it's the wrong layer to protect in. People must rely on properly-configured OS-level permissions for securing against untrusted developers."
darthcamaro writes: Over 60 bugs were reported in PHP over the last 30 days, should PHP users and developers be worried? Most of the flaws however are ones that developers themselves can protect against with proper coding practices according to the Andi Gutmans CEO of commercial PHP vendor Zend. He argues that PHP security is a matter of setting expectations. In his view, PHP — like all development languages, is only as secure as the code people that write code with it.