To my knowledge there’s not too many things on the internet that are not exploitable. If someone is gung ho to find a way in, that is…
As far as php being highly exploitable, that depends on the coder. I do however think using highly as an adjective is being a tad over dramatic.
Thanks for your opinion inputs.