Is it posible thart a user hack a server running apache from a website? Let's say I have a Php web application running under Apache with explicit user `www-data` in the virtual host configuration. Even if the user hack the website, he has access to modify the php code then write some codes to access `system files` which can only be accessed with `root user` and `user files` which can only be accessed with `myUser user`. Can the hacker take control of the `operating system`?

**Note: I asked that question on Serverfault but someone suggest I ask in here.**