Security quotes of the week

Most PHP setups tend to leave the PHP files in the web root, with a configuration that says "run .php files via php rather than serving them". With a setup like that, it only takes one web server misconfiguration to cause the server to serve the file as text rather than running it.

A much better configuration would have all the PHP files outside the web root, where misconfigurations would fail closed by not serving them.