The point of this thread, and of defense in depth generally, is to limit the scale of "hell" and to trivialize the impact of "on the host".

Look, at the end of the day, every major security researcher is going "oh shit" and no amount of tweaks to your configuration is going to limit the blast radius in a way that will actually matter. You're going to need to update PHP, that's the _only_ solution to this problem.