I remember when mounting /tmp noexec and chmod g-w on htdocs was enough.