[LukasReschke]

Just as a remark, we run a bug bounty program at https://hackerone.com/nextcloud offering up to $5,000 for Remote Code Executions.

If someone here feels challenged: We look forward to your reports. :)

[newsat13]

This is a great response :-) Especially to people who "claim" PHP is hackable with no follow through.