I was reminded that PHP is still the only programming language in which a version deployed into production gave "Hello, world!" at least one RCE vulnerability. The one I have in my notes is CVE-2012-1823.