A persistent worker is a long-lived process that handles multiple requests instead of starting fresh for each one. PHP-FPM commonly uses this model to serve web requests efficiently. Because the process remains alive, data or other state from one request can remain in memory and affect later requests if the application or runtime does not clean it up correctly.
This matters for security when request-specific state is reused across users or operations. In an attack, a flaw may let an attacker influence a worker’s state and cause a later request to use it incorrectly, potentially exposing data or enabling code execution. Defenders should apply runtime and application fixes, recycle workers when required, and monitor for suspicious request patterns. Correct cleanup and isolation between requests reduce the risk of cross-request effects.