PHP 7.4, 8.0 and 8.1 get no patch for this week's unauthenticated RCE flaws. Not now, not later. There is nothing to put in a backlog here, the stack is dead.
Staying on PHP? Then move to a patched 8.2+, set session.upload_progress.enabled=0, and ask your host what they actually patched. Want off it? Write to us today with the service, and within a day you get the cost and the week count. We have done legacy rewrites before, and small services take days, not months.