Just to add on, if your server is hosting multiple domains for clients so you can't just do a blanket function disable, you should look into suhosin to do per domain function blacklist.