I saw some conflicting information in Google searches about the disable_functions php.ini directive. A couple people said that the disable_functions php.ini directive no longer works in PHP 8. That is incorrect. I just did some testing on a server with PHP 8.2.12 on it and the disable_functions php.ini directive still works.
You would add this directive in either a php.ini file or a .user.ini file in the root directory of your hosting account. These php functions below should be disabled.
disable_functions=system, exec, passthru, shell_exec, show_source, popen, pclose