Unix permissions and suexec I seem to recall, with other mitigations (chroot I think, but it's been a while since used it)