It seems like your webserver just returns any PHP file instead of executing it.
So check your webserver config again and make sure PHP is properly set up.
This also means that anyone can simply access your config/config.ini.php and see its content unless you have some setup that protects from this (you can check https://yoursite.example/matomo/config/config.ini.php) which means you should reset the Matomo salt and your MySQL password as people might have seen them.