This is whack. Op has setup the server to be impossible to exploit, then challenged people to exploit.
The non default php settings he set break the exploit.
The non default php settings he set break the exploit.
If that's the case, then there is a mitigation for all vulnerable versions, but the team that released php2shell said there is absolutely no complete mitigation and every PHP version between 5.4 and these latest updates is absolutely vulnerable. So which is true?
Unfortunately that's only enough to serve a static site and definitely not why or how anyone deploys PHP.