A web accessible PHP runtime is, in fact, a giant security vulnerability and always had been.