How To Stop This Attack [Bypass Safe_mode & Openbase Dir]

Recently, some of our Linux/cPanel servers got hacked (not rooted) by using the following code (method)

#!/usr/bin/perl
symlink ("/home/USER/config.php","/home/USER2/test.txt");

The hacker just execute the perl file , and then he called the "test.txt" file through internet explorer , and its done , he can read the file easily !

We tried to :

1- run php as CGI module.
2- run SUPHP module.
3- run php as apache module.
4- enable open_basedir and safe_mode.

But the hacker still can bypass the system!

the only solution is to disable /usr/bin/perl , chmoded it to 700 . but thats caused a broken cpanel!

as it requires it to be at 755 for proper operation, since it is used by customers as well when it suexec into the user when they log into cPanel. and so we cannot change it to that setting (700), since it breaks the entire system.

So is there any way to stop the "symlink" perl function?

any way to stop this attack method?