Request-owned state is data created or used while handling a single web request. It may include request-specific variables, buffers, or runtime metadata, and should be cleared or reinitialized before the process handles another request.
This separation matters in long-running server processes: stale state reused across requests can cause incorrect behavior or expose one request’s data to another. In PHP runtime security, a flaw involving request initialization or cleanup could leave old state available when a later request is processed. Defenses include correct lifecycle handling in the runtime, keeping supported versions patched, and testing services that reuse processes across requests.