Clarify suhosin should be disabled (or at least phar whitelisted)