Process ancestry is the chain of parent processes that led to a program running. Every process on a Linux system is started by another process, so you can trace a running command back through its parent, that parent's parent and so on. Defenders use this chain to understand where a command came from and whether that origin makes sense.
For web servers, ancestry is a useful signal. A web server or application runtime, such as a PHP worker or a Node.js process, normally handles requests and does not usually start an interactive shell or system utilities. If a process in that chain launches a shell or a command that the application has no reason to run, it is worth investigating, because it can be a sign that the application was made to execute something unintended.
Ancestry is a lead, not proof. Some legitimate applications do run external commands, for example for image processing, backups or deployment, and scheduled jobs or administrators can also start processes in ways that look unusual. Equally, an attacker may not produce an obviously odd chain, and very short-lived processes can be missed if nothing is recording them. The absence of a suspicious chain does not show that a system is clean.
To use it well, collect process execution data with endpoint or audit tooling, learn which parent-child relationships are normal for each application, and alert on departures from that baseline. When something looks wrong, check the full command line, the user account involved, the time, and related web and system logs before deciding whether it is a real incident.