cgi.fix_pathinfo => 1; php.fpm-security.limit_extensions => .php. Fixes #964