Description:
------------
I use the 7.3.14-1 package from debian stable repository (built: 16 Feb 2020).
I have opcache enabled with common settings taken from the doc:

opcache.enable=1
opcache.memory_consumption=128
opcache.interned_strings_buffer=8
opcache.max_accelerated_files=10000
opcache.revalidate_freq=60
opcache.enable_cli=0 (This I believe we do not care)

I've got several apache virtual host and each has a specific open_basedir. However, I can bypass the open_basedir restriction if I do a require on a file used very often (typically, defines.php where I store mysql password !). The issue disappear when I restart apache2/php: that is, I have an "open_basedir restriction in effect" message. In my opinion this is because the cache of opcache is empty. Then, after loading a few pages, I can require the file despite it's not in my open_basedir.

NB : It may just be that it is not really a security issue and that any admin with several websites shouldn't use opcache. But in that case, I think the doc should mention this (it's not the case yet).

Test script:
---------------
<?php
/* My open_basedir is /var/www/foo */

require('/var/www/bar/passwords.php');//Works if password.php is in opcache table