Also a pentester here. I find C and PHP to be quite different. Somehow, C applications always have catastrophic issues pop up, sooner or later, where you can make it execute random code at least under some circumstances. PHP applications can be the same if the team is inexperienced or doesn't get the necessary time to apply best practices, but I've also seen plenty of PHP applications where we didn't find significant issues with the server-side aspects.
PHP applications are fun to test because most teams found another set of solutions to the same problems (it has so much history that wheels have been reinvented a lot), so you get to see new things. They're also typically larger than newer and new-style services written in a shiny new language, which haven't had time to accumulate as many features and are often written as a microservice (smaller components where one/each dev can know all the ins and outs, allowing to have a total overview so that security controls can much more easily be implemented in a unified way).
PHP applications are fun to test because most teams found another set of solutions to the same problems (it has so much history that wheels have been reinvented a lot), so you get to see new things. They're also typically larger than newer and new-style services written in a shiny new language, which haven't had time to accumulate as many features and are often written as a microservice (smaller components where one/each dev can know all the ins and outs, allowing to have a total overview so that security controls can much more easily be implemented in a unified way).