Comment by huhtenberg

On nginx a stop-gap measure is to block all multipart posts before they reach the php code.

Add this to nginx.conf (or drop as a text file into /etc/nginx/conf.d/) :

  map $http_content_type $block_multipart { default 0; ~*^multipart/form-data 1; }

Then in every 'location /' block for every hosted server:

  location / {
    if ($block_multipart) { return 403; }
    ...
  }

Then restart nginx.