advice request for shared hosting and security issue

Hi,

I have a Debian Squeeze web server running PHP-FPM, fastcgi with apache2. I
used dotdeb sources to install php-fpm and fastcgi. There are many vhosts
defined on them, each has their own pool configuration and working without
problems.

My current problem is about the PhpSpy program. It is a PHP file that runs
dir, chdir, readdir commands and let the user traverse the file system and
read files. I couldn't figured it out a solution for it.

I used chroot option at the pool configuration which didn't worked. It
seems there is a but with Apache2 and Fastcgi usage. I enabled suexec also
which didn't helped.

I can try to disable opendir, chdir commands globally then some php files
under vhost directories will be broken.

What is the solution? Should i set chroot? If so how? Any working
combination will be great for Debian Squeeze.

I will be appreciated if there is an easier solution also.

Below include the detail conf files and my question i asked to
stackoverflow:
http://stackoverflow.com/questions/17251170/php-fpm-is-not-working-as-expected

Will be great if someone help.

Cheers.

-- 
Oğuz Yarımtepe
http://about.me/oguzy