PHP doesn't have direct access to syscalls. (not without extensions anyway) exec / system / other shelling out functions should be disabled unless you actually know you need them.