It can be but in my anecdotal experience the mess left by PHP developers is the worst. Especially when it comes to blatant XSS and SQL injection vulnerabilities PHP holds a clear lead.

There is a strong correlation. PHP makes it very difficult to write correct code. An app written in a language that goes out of its way to help you create more bugs is going to have, on average, more bugs than one written in a language that does not.