Limit memory outside PHP

CVE-2026-109618

This is a temporary setting. It reduces the risk but does not fix the bug. Update PHP to fix it for real.

Needed when you use memory_limit = -1, so one request can't take down the server.

How

• systemd (PHP-FPM): sudo systemctl edit php8.3-fpm, then add [Service] and MemoryMax=2G
• Docker: docker run --memory=2g ..., or mem_limit in compose
• Kubernetes: resources.limits.memory

Best is a setup that kills only the worker that used too much memory, not the whole service.

Don't use ulimit -v / RLIMIT_AS / RLIMIT_DATA. They can cause the exact failure that triggers the bug.

Source: php.net