We have a server and use it as a shared-server for our clients. Most of the clients use Wordpress and we have a classic LAMP environment set for it. We give SFTP access to each client (with chrooted users of course).
Normally, clients are isolated from each other this way; but we're afraid that if any of them uploads a PHP exploit just like Filesman, they can get access to the system and do anything they want (e.g. listing files, changing files).
To avoid this, we tried to disable some PHP functions as explained on cyberciti.biz; but still Filesman works. We couldn't do anything to stop it.
What can we do to avoid such situations? Can someone enlighten us here?