Historically, a lot vulnerabilities in PHP projects were because of PHP itself. Things like register_globals, remote includes/reads using functions that supposed to read local data and so on.