There have been plenty of exploits in PHP-as-a-language too, you know.
But even disregarding that, language and API design is very important. And PHP in many ways encourages insecure programming, by making secure programming hard to get right, and not obvious. The mysql functions are a prime example. They are incredibly, incredibly dangerous to use, and lots of tutorials for them do not adequately explain how to use them securely.
In contrast, languages like Perl and Python have database access functions which to a far greater extent promote secure programming.
Being that PHP is often written by very inexperienced programmer, this become a very dangerous combination, and we see the results in exploits in PHP programs all over the net all the time.