This bug could potentially hit any language. The issue lies in the parsing of the number. The fact that php triggers that parsing implicitly is incidental. It could just as well happen in e.g. Java using an explicit Double.valueOf(vulnerableString)