Setting memory_limit = -1 can prevent some attack paths that rely on PHP's memory-limit handling, but it transfers memory-exhaustion handling to the operating system. With this configuration, memory-exhausted workers may be terminated, interrupting requests and affecting stability and availability of the server. If you decide to enable this, use Linux cgroup v2 memory.max, or an equivalent operating-system mechanism, to help contain resource consumption and limit the availability impact to PHP processes. Apply configuration changes administratively and restart the affected workers.

Do not use RLIMIT_AS or RLIMIT_DATA as replacement memory limits. The PHP advisory warns that these can trigger the same vulnerable failure paths.

This measure does not cover application-specific large-allocation paths or non-memory-related triggers. In threaded deployments, terminating a process can also interrupt requests running on other threads.