So that's my feedback: at least remove the ability to upload PHP files onto Updrop. And then disable PHP for upload folder altogether.