The request lifecycle is the sequence of steps a server takes to handle one web request, from receiving and parsing it through application processing and response delivery to cleanup. In PHP, this includes initializing request-specific state, running the application code, and resetting or releasing resources when the request ends.
Security depends on each stage keeping data and memory in a valid state. A flaw during processing or cleanup-such as stale request-owned state being reused-can expose data or, in some cases, help an attacker execute code. Defenders should keep runtimes such as PHP patched, verify the versions actually serving requests, and restart affected workers so fixes take effect. Reviewing lifecycle-related errors and isolating worker privileges can also limit risk.