I think putting my PHP site behind Cloudflare would be the least I would do if I wanted to keep it online before PHP can be patched. The other alternative is trying to block multi-part uploads before they reach PHP.
Make sure to create CF tunnel to your server and to reject all traffic frin other sources, or to accept traffic only from known CF ips. Otherwise, you're still exposed, even if CF WAF works.