PHP is a good start, because it's easy to learn.
And knowing html/css you can quickly start doing some real website to practice it.
As for IT security, C/C++ would be good, to start learning from the low-level languages. But it will not be easy to switch from PHP to C as it is more difficult to learn/program.
So, since you have a couple of years ahead, my advice is to start from C.