I tried to disable symlinks in apache so I updated apache2.conf (on ubuntu) to:
<Directory />
Options -FollowSymLinks
AllowOverride None
Require all denied
</Directory>
but still symlinks continue to be followed for cgi-bin, from the browser. Is there a different way to accomplish this?