Question

From your experience, are there any security measures that one should undertake on a VPS before including files with absolute paths (opening /, eg. /common/lib.php or /images/image.jpg)

Answer 1

Yeah, there is one for sure.

Make sure that you turned display_errors off, to make all the error messages you will get invisible to the user.

Then make these paths real, by adding $_SERVER['DOCUMENT_ROOT'] to them or any other way.

And yes, as long as you are using this kind of code

include $_SERVER['DOCUMENT_ROOT'].'/common/lib.php';

using no dynamically generated filenames

you may consider yourself safe.