The current PoC in the public gets there via that method, and even then you don't need to call system() alone to cause hell on a host...

The point of this thread, and of defense in depth generally, is to limit the scale of "hell" and to trivialize the impact of "on the host".

	▲	Operyl 5 hours ago \| parent [-]
		Look, at the end of the day, every major security researcher is going "oh shit" and no amount of tweaks to your configuration is going to limit the blast radius in a way that will actually matter. You're going to need to update PHP, that's the _only_ solution to this problem.