While it is true that PHP is evolved more than it is designed, and as such retains the hallmarks of earlier generations and sometimes surprises you with its ana

While it is true that PHP is evolved more than it is designed, and as such retains the hallmarks of earlier generations and sometimes surprises you with its anachronisms, it is not true that this makes it impossible to create secure software. It just takes more discipline to avoid cutting corners. The same goes for many other languages and platforms so PHP is not alone here. That aside, Nextcloud and similar user-extensible platforms are very hard to secure as it only takes a single slip of the thought by a single app author to open up the doors for unwanted visitors. As it is just the flexibility which gives Nextcloud (et al) its appeal this is a hard problem to solve.