The usage of PHP in enterprise appliances is actually pretty wild - many firewalls, load balancers etc are using PHP for management plane activities. There is a lot out there outside of userland, and those are the appliances most vulnerable in my opinion. A compromised firewall is worse than a compromised website.
70% of the internet? No. The web? Yes, maybe. These are not the same thing.
The usage of PHP in enterprise appliances is actually pretty wild - many firewalls, load balancers etc are using PHP for management plane activities. There is a lot out there outside of userland, and those are the appliances most vulnerable in my opinion. A compromised firewall is worse than a compromised website.