PHP: disable risky functions

; php.ini (or per-site FPM pool)
disable_functions = exec,passthru,shell_exec,system,proc_open,popen,show_source
expose_php = Off
allow_url_include = Off