The built-in default is 128M, and -1 means no limit. When a script tries to use more, PHP stops it with a fatal error saying that the allowed memory size has been exhausted. The cap protects the server from a runaway script taking all the memory.
Because CVE-2026-109618 in PHP2Shell begins when memory runs out in the middle of a request, PHP's advisory gives an unusual partial mitigation: set memory_limit to -1 administratively, for example with php_admin_value in the FPM pool or Apache configuration, and make sure nothing else sets a finite limit again. With no PHP-level cap, the problem is not triggered by hitting that limit.
This comes with a trade-off. Without a cap, a single request can use all available memory, so the advisory recommends a container or cgroup limit that stops only the affected worker. It also warns against RLIMIT_AS and RLIMIT_DATA, which can force the allocation failures the flaw depends on. After you have updated PHP, restore a sensible finite limit.
This is a stop-gap and not a fix. Treat the PHP update as the real remedy, and check every pool and application for settings that put the limit back.