An actionable takeaway is to disable eval in php.ini. Not always practical but i doubt everyone needs it.