From the looks of this (and a casual google), this appears to be a broad php attack, and not specific to concrete5.

My understanding is that it's looking for scripts that use that server array variable AND have register_globals set to On. Register_globals is something that should always be left off, which is has been the default for a long time.

I'm not sure what can actually be configured with suhosin, but one suggestion would be to get it to blacklist any IP that triggers that kind of rule, instead of shutting down apache. That kind of request is ONLY going to be dodgy, not a legitimate request.

Or if it's one particular IP all the time, I'd just blacklist that manually.

With server permissions, I'd agree with your thinking to reduce them where possible. Site hack scripts often target index.php and .htaccess files indiscriminately (regardless of cms), so if you've set them as completely unwritable, it's going to be another barrier.

As a side note, this month has seemed really active for hackings, I'm wondering if it's just what I'm seeing or if there is a large increase in activity. Wordpress has been a big target for brute force attacks, but legacy Joomla sites seem to have suffered a lot as well.