From: Debian PHP Maintainers <pkg-php-maint@lists.alioth.debian.org>
Date: Sat, 2 May 2015 10:26:52 +0200
Subject: php.ini_securitynotes

---
 php.ini-development | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/php.ini-development b/php.ini-development
index 990e095..c768f17 100644
--- a/php.ini-development
+++ b/php.ini-development
@@ -302,6 +302,12 @@ serialize_precision = -1
 ; or per-virtualhost web server configuration file.
 ; Note: disables the realpath cache
 ; http://php.net/open-basedir
+
+; NOTE: this is considered a "broken" security measure.
+;       Applications relying on this feature will not receive full
+;       support by the security team.  For more information please
+;       see /usr/share/doc/php-common/README.Debian.security
+;
 ;open_basedir =
 
 ; This directive allows you to disable certain functions for security reasons.