If you look at a PHP application like Mediawiki (wikipedia), it's obvious how the lower-level code could be better written in Java.

According to Rapid7, the vulnerability has been found in injectable code payloads through the Swagger Code Generator for NodeJS, PHP, Ruby, and Java.

Its top 10 were JavaScript, Python, Java, PHP, C#, CSS, C++, TypeScript, Ruby, C, and Swift. Rust was in 19th spot. Notably, though, Java was not one of the languages to see much growth on GitHub.