Is it possible that a user can hack a server running apache from a website? Let's say I have a Php web application running under Apache with explicit user www-data in the virtual host configuration. Even if the user hacks the website, he has access to modify the php code then write some codes to access system files which can only be accessed with root user and user files which can only be accessed with myUser user. Can the hacker take control of the operating system?

Note: I asked that question on Serverfault but someone suggest I ask in here.