Two good articles on how to mitigate security issues when running multiple sites under a single master php-fpm process that may lead to sites leaking OPCode cache data.

https://ma.ttias.be/mitigating-phps-long-standing-issue-opcache-leaking-sensitive-data/

Further mitigation is to have multiple php-fpm masters for each site.

https://ma.ttias.be/a-better-way-to-run-php-fpm/