this may be of interest, I've been chatting to the author today actually. https://db.usenix.org/events/leet10/tech/full_papers/Checkow...

The site is secure but can always do better.

Wow, that makes it sound hard to do.

Its not a given but it is doable, the main/basic line of defence is using a chroot jail and having nothing in that root of any interest/value. When I get chance I will do a blog post on it.