4 is a different bad thing, like if everyone trusts John Internet to say what the real Google Dot Com is and John made his password "4". One of the several Johns Internet, anyhow
The PHP thing is that anyone can take control of part or all of a server that uses PHP and isn't on the latest update
