php files can be executed

I just performed a Panopoly upgrade on a dev site I'm working on and it went well. However the Security Review is showing 6 errors out of a possible 10 items and I haven't altered the basic Panopoly at all, I just added some modules and content. I'm wondering if these errors are normal for Panopoly and whether there are any guidelines for fixing them if they are typical for Panopoly.

I have fixed a few issues such as adding a base URL to the settings.php and "Errors are written to screen." But I'm not sure how to fix

"PHP files in the Drupal files directory can be executed."