Yes, the PHP risks have been known, and partly assumed. I watched a group from MIT ignore sage advice on avoiding PHP but built their administration interface with it anyways. Now this device is deployed in heavy industry, in mining, in transportation, in healthcare, it's deployed everywhere and in multiple continents and in multiple huge cities. It's concerning that the recommendations we made were eshewed and they went ahead with this anyways and now we are in this situation. This group from MIT had formed a company, and they were bought by a large network device manufacturer. It's deeply deeply concerning.

> sage advice on avoiding PHP

That's not sage advice. That's just biased, reactionary rhetoric. PHP is just as good or bad as anything else, and it's often the best tool for the job. As with any other language, it can be implemented correctly or incorrectly.