AFAIK, PHP security hazards are mostly "down in the language". Meaning that you can avoid a lot of them with suitably defensive programming. Things like turning registers_globals off, checking your incoming variables contain what you expect them to contain, always escaping stuff before you stuff it anywhere, that kind of thing.

Wade.