Yes, it is PHP's fault. It's endemic to the general attitude of the PHP team.
"Now just marginally less braindead than every other language" isn't exactly a selling point.
Sure, it used to be worse, but I see zero commitment from PHP to actually make real steps to fixing the situation. A real first step would be to start working on a 6.x release that actually removes the gazillion deprecated-but-still-present-and-thus-used things in the language.
http://php.net/manual/en/security.globals.php
5.3.0 is 2 and a half years old.