First of all: BIG THANKS to @nachoparker for all the work (already donated).
Since ncp has a more than handy collection of settings, I was wondering, if a switch for noexec, nodev , nosuid, for the data partition would be a good idea? I had this idea for a while, now with PHP FHM this might be even more vivid?