Ubuntu – Securing PHP via open_basedir based on script path

First, DON'T capitulate. He is not only an idiot but DANGEROUSLY wrong. In fact, releasing this information would violate the PCI standard (which is what I'm assuming the audit is for since it's a payment processor) along with every other standard out there and just plain common sense. It would also expose your company to all sorts of liabilities.

The next thing I would do is send an email to your boss saying he needs to get corporate counsel involved to determine the legal exposure the company would be facing by proceeding with this action.

This last bit is up to you, but I would contact VISA with this information and get his PCI auditor status pulled.

The fpm project did a great job allowing the deploy of shared hosting solutions quite easily, even chrooting the users (however, there are some problems with apache that could be solved through symlinking; there are a lot of tutorials on the internet about it).

The solution involving php5-fpm requires mod_fastcgi and allows the hoster to make per-user configurations (memory_limit, max_execution_time... just as an example), and from what I've been able to see, it's pretty stable ;)
About the problems with resolving and using the emails, they're easily solved adding the libraries to the chrooted environment and the executables needed (sendmail for example).

The problem I've found and I'm solving, is about the wrong variables passed to the php scripts by the php-fpm (after chrooting, php-fpm should remove the outside directories, passing to the script only the ones inside the chroot... but it doesn't and something else must take care of that, something like a proxy between mod_fastcgi and php-fpm).
I've managed to solve the problem using a fcgi proxy between php-fpm and apache that automatically corrects the variables, since php-fpm at the time I am writing doesn't manage to fix them.