.htaccess deny code execution not working for Apache + php-fpm

[magenx]

1. Magento 2.1.1
2. cPanel EasyApache 4 (edge)
3. apache 2.4 + php-fpm

Steps to reproduce

1. upload php file to pub/media/
2. execute in browser

Expected result

1. code execution in some folders must be denied

Actual result

1. php files executed and working good

as a quick test, this works for any handler:

<FilesMatch \.(ph.+|sh.+|htm.+|cgi|[aj]sp|p[ly])$>
Order allow,deny
Deny from all
</FilesMatch>

[BaDos]

Hi, @magenx

Thank you for your feedback!
Internal ticket MAGETWO-60633 was created.

[veloraven]

This issue was fixed for develop branch.
Closed.

[korostii]

Hi @veloraven,
This seems to be a security issue.
Is there a backport planned to 2.0.x and 2.1.x?