New option under Website → Advanced → Site Options: Block PHP in paths blocks web requests to .php files under paths you list, one per line.
Paths may be regular expressions, e.g. /app/uploads/.
Use it to prevent PHP execution in upload or static-file directories - typically Bedrock sites, where uploads live under /app/uploads/ instead of the always-blocked wp-content/uploads.
WordPress itself still runs PHP normally; only direct requests to .php files under the listed paths are blocked.
See What's blocked on Templ for details.