I have OO PHP application which serves pages as well it does payment card processing via external RBS payment gateway. There is also reporting database. The problem is when somebody exploits this PHP, he gains access to all the information about all users as well other reports plus he can modify pages via SQL. There is also admin, which is in separate folder (admin/). There are 100 websites pointing to the same document root and there are dozens of various modules with potential bugs. Do you have any preferable method for this? Currently it runs Ubuntu 12. The CMS I did myself, it's made out of several modules, for both frontend and backend.
Update: It is multi-tenant application.