PHP vs. VBScript

After having used PHP and now VBScript (and ASP, though only for a short while this week), comment on what you believe might be the relative merits of using either the open source or the proprietary product in a commercial project.  Although we have discussed this somewhat in a previous week, what about from the vulnerability aspect in terms of viruses. In many of the recent virus attacks, and indeed email attacks, weaknesses or loopholes in VB-scripting have been exploited. Does this mean the proprietary product is inherently weaker or less suited for use in a secure environment?

MUST PROVIDE ALL REFERENCES