hey there,
found the same issue today! crazy
Ubuntu 22.04.3 LTS
Plesk Obsidian 18.0.58 Update #2
PHP 8.3.2 FPM Handler with nginx without apache
all static files are protected (like. html, .js, .css and images)
but all php files are served without protection