Apache Permissions

[joximu]

apache can read - and maybe write all which belongs to it's group www-data.
So far it's correct.

The big question is: is apache writing there or anything else?

If you want to write there using a php application then world writeable seems the only solution (and no mor risk than writable to all users...). PHP runs as userid:groupid of the domain user...

You also can switch back to the past and use mod-php instead of php fastcgi/suexec..