A runtime copy is the version of a script or web page that exists in memory while a server is processing a request. It is the live copy the web server or application actually executes and sends to the client, which may differ from the file stored on disk.
This matters because attackers can tamper with the runtime copy without visibly changing the underlying file. In a web shell or appliance compromise, that can let malicious code alter responses, capture credentials, or run commands while file-based scans still look clean. Defenders should verify served content, not just stored content, using response diffing, integrity checks on the request path, and monitoring for unexpected server-side behavior. On systems that generate pages with PHP or similar code, the runtime copy is part of the attack surface and must be treated as security-sensitive logic.