> as of my comment, this is not endorsed by PHP

Are you speaking officially here?

There are various mitigations suggested online, including completely blocking multipart requests at LB level. Is the combination of both effective?

I wouldn't skip updating, but is there anything else we can do, other than simply shutting down the web server until the fix is available?