Oxygen 4.8.2 is now available.
By design, Oxygen's "Client Control" feature allows those with Oxygen access to execute PHP.
This feature is off by default, and there is a security notice labeled "Important Security Warning" directly above the feature with more details. This security warning has been present for the last 6 years.