Damn right this should not happen - and if you're the admin for the site it's your fault it has happened
We are considering mod_php and FastCGI,
This is nothing to do with the problems you are currently having nor how you go about making the system secure.
First thing you need is a permissions model and processes to support the deployment of code to the server in a controlled way.
One approach would be to set up a group for each project which excludes the webserver uid, then deploying all files as rw-rw-r for the user and the development group - webserver relies on 'other' permissions to read files. Set up all directories with the group sticky bit set.
Each project should be in it's own subdir within the document root, and each project should have an upload dir writeable by the webserver uid outside the document root, and at least one dedicated (per group) include dir outside the document root (for preference each should be on its own vhost). Access should be restricted by open_basedir
Publish a coding standard which should specify that permissions cannot be manipulated from the standard settings - and tweak your IDS to pick up on any PHP files added or permissions changed.
But there are other models.
The important thing is that:
The webserver should never be able to write to files accessible directly via the webserver.
If user-uploaded content is to be accessible, it should be thouroughly sanitized on upload, and access mediated by a controller script.
in the event that malicious code is deployed on the server it should be strictly limited in the amount of damage it can do
it should be possible to detect when code changes are made on the system
Your permissions model should prevent one project from interfering with the behaviour of another project (e.g. suppose you had a common 'include' dir - even if the different projects could not amend other's files, they could mask out behaviours by using the same filename elsewhere on the include path - or worse create errors by using the same function or class name twice).