security updates: no PHP or Python support, no directly starting external applications