Yes, there have been decades of talk about this already—ensuring you isolate/jail the PHP-related processes and run them with an unprivileged user, etc.