Request shutdown is the final stage of handling a web request. The runtime runs cleanup tasks, releases request-scoped resources, and may process deferred callbacks or destructors before finishing. In PHP, this work happens after the application has handled the request, but it still involves runtime state and memory.
Shutdown matters in cybersecurity because a memory-management flaw or corrupted state can become dangerous during cleanup, even if the initial request has already been processed. In an attack, a crafted request may trigger a vulnerable error-handling or cleanup path, potentially causing a crash or, under specific conditions, code execution. Defenders should apply the relevant runtime or vendor fixes, verify the running package and service restart status, and review logs for unusual errors. Request shutdown is a lifecycle stage, not evidence by itself that a system is vulnerable or compromised.