disable_functions = exec, shell_exec, system, passthru, popen

; php.ini
file_uploads = On
upload_tmp_dir = /secure/upload/tmp
open_basedir = /var/www:/tmp

nginx.conf
autoindex off;

location ~* /cgi-bin/ {
            deny all;
            return 403;
        }

        location ~* /uploads/ {
            deny all;
            return 403;
        }