PHP is as secure as any other language, the problem is the implementation of it.
For example I can upload a file to a webserver and the webserver is executing it instead of just reading it as text, It can be php, aspx, ruby, flask, doesn’t matter, from the point of view of the attacker the only thing that changes is which webshell he will upload.
Regarding your experience, everything was a security nightmare in the early 2000’s PHP was no exception.