[1] shows 143 code execution CVEs in the past 20 years. Now, to be fair, this site has been known to misclassify bugs in the past and it's likely that most of t

[1] shows 143 code execution CVEs in the past 20 years. Now, to be fair, this site has been known to misclassify bugs in the past and it's likely that most of those bugs don't apply to NextCloud or weren't even RCEs. However it's hardly unheard of for PHP to have RCEs. Usually the RCEs are in programs written in PHP, but PHP itself is hardly blameless. For comparison, Python has had 5-10 code execution CVEs in the past 10 years. And again, I'm not bashing PHP or NextCloud here. I would probably also firewall NextCloud if it was written in Python. The only thing protecting your data from being public is a single service that you are running and gated by a basic login form -- I personally feel much safer with it behind a WireGuard VPN. [1]: https://www.cvedetails.com/product/128/PHP-PHP.html?vendor_id=74 https://www.cvedetails.com/product/128/PHP-PHP.html?vendor_i...