PHP powers over 76% of websites worldwide, making security vulnerabilities in its applications particularly damaging. Unfortunately, such defects remain common: in 2021, nine of the top 15 most-exploited vulnerabilities identified by CISA involved remote code execution (RCE). Prior research has attempted to contain RCE through system call filtering (e.g., via seccomp), but these efforts are typically coarse-grained. They allow all system calls that could potentially be invoked anywhere in the application, providing attackers substantial opportunities for exploit. We introduce a fine-grained, state-sensitive approach that builds an automaton for each PHP script, mapping different execution stages to carefully curated system call subsets. At runtime, our kernel module combines information from system call traces and PHP script-level events to apply these context-driven allow-lists. We demonstrate our method’s effectiveness against real-world CVEs and against attackers crafting RCE payloads designed to mimic legitimate calls. Our model successfully detects these “stealth” attacks and maintains a low performance overhead of only 1%—a substantial improvement over the 5% overhead observed in prior work.