You're right, you should just leave your PHP totally unprotected.
I would recommend running this binary as a user that has no access to any files, it can just proxy traffic through a port. I will put that in the README.
Yes. Take your PHP service offline for the next year, until you can find a way to migrate it off your host and rebuild the PHP yourself on your environment. That'll help.