diff --git a/lib/os/class.ISPConfigDebianOS.inc.php b/lib/os/class.ISPConfigDebianOS.inc.php
index 309971d27cbb89ca0ccfaa9955f4b7a500590496..9df260174a91fa1764ca1b53a162df70e67e29e5 100644
--- a/lib/os/class.ISPConfigDebianOS.inc.php
+++ b/lib/os/class.ISPConfigDebianOS.inc.php
@@ -282,38 +282,44 @@ class ISPConfigDebianOS extends ISPConfigBaseOS {
 Alias /phpmyadmin /usr/share/phpmyadmin
 
 <Directory /usr/share/phpmyadmin>
- Options FollowSymLinks
- DirectoryIndex index.php
+	Options SymLinksIfOwnerMatch
+	DirectoryIndex index.php
 
- <IfModule mod_php7.c>
- AddType application/x-httpd-php .php
+	# limit libapache2-mod-php to files and directories necessary by pma
+	<IfModule mod_php7.c>
+		php_admin_value upload_tmp_dir /var/lib/phpmyadmin/tmp
+		php_admin_value open_basedir /usr/share/phpmyadmin/:/etc/phpmyadmin/:/var/lib/phpmyadmin/:/usr/share/php/:/usr/share/javascript/
+	</IfModule>
 
- php_flag magic_quotes_gpc Off
- php_flag track_vars On
- php_flag register_globals Off
- php_value include_path .
- </IfModule>
+	# PHP 8+
+	<IfModule mod_php.c>
+		php_admin_value upload_tmp_dir /var/lib/phpmyadmin/tmp
+		php_admin_value open_basedir /usr/share/phpmyadmin/:/etc/phpmyadmin/:/var/lib/phpmyadmin/:/usr/share/php/:/usr/share/javascript/
+	</IfModule>
 
 </Directory>
 
 # Authorize for setup
 <Directory /usr/share/phpmyadmin/setup>
- <IfModule mod_authn_file.c>
- AuthType Basic
- AuthName "phpMyAdmin Setup"
- AuthUserFile /etc/phpmyadmin/htpasswd.setup
- </IfModule>
- Require valid-user
+	<IfModule mod_authz_core.c>
+		<IfModule mod_authn_file.c>
+			AuthType Basic
+			AuthName "phpMyAdmin Setup"
+			AuthUserFile /etc/phpmyadmin/htpasswd.setup
+		</IfModule>
+		Require valid-user
+	</IfModule>
 </Directory>
 
 # Disallow web access to directories that don\'t need it
+<Directory /usr/share/phpmyadmin/templates>
+	Require all denied
+</Directory>
 <Directory /usr/share/phpmyadmin/libraries>
- Order Deny,Allow
- Deny from All
+	Require all denied
 </Directory>
 <Directory /usr/share/phpmyadmin/setup/lib>
- Order Deny,Allow
- Deny from All
+	Require all denied
 </Directory>';
 		if(ISPConfig::$WEBSERVER === ISPC_WEBSERVER_APACHE) {
 			file_put_contents('/etc/apache2/conf-available/phpmyadmin.conf', $contents);