[dreamhost]

I can't speak for php-nuke as I have never run it before, but I can speak to postnuke.
I have run postnuke for about 2 years now on literally hundreds of client websites. We have never had a single website compromised which is actually shocking to me but true.
From what I understand about the history of the nukes, postnuke came about due to a desire to increase the security of the cms over phpnuke. We have tools like the pnanticracker which checks for injected code and rejects it based upon a set of predefined rules.
There is no such thing as a totally secure application but postnuke does seem to do a fairly good job there. I have found that most security issues are more related to your server setup vs. the cms itself. Take care of those issues first, and your on your way to a fairly solid cms.
We spent months custom coding script connectors that go between postnuke, photopost, vbulletin, and other applications in order to unify the registration and login process. It just wasn't professional to ask people to register 2x in order to use both systems, (imagine having to sign in 2x at msn for your mail, chat etc.... yeah right..).
All I can say is our users absolutelly love the system, and we now get just as much traffic to the pn side as the vb side of the site.