The PHP Foundation, which oversees the maintenance of the widely used PHP programming language, is currently operating with only one full-time employee. Executive Director Elizabeth Barron confirmed that the organization relies on 14 part-time contractors and volunteers to manage the language that powers approximately 70% of websites globally.
The foundation's operations are funded through corporate and individual donations. Recent security challenges have highlighted the resource gap, as researchers discovered two critical vulnerabilities that had existed for about a decade. These flaws prompted emergency patching across Europe and caused several government websites to go offline temporarily.
The PHP Foundation collaborated with OpenAI, Wiz, and Calif to address the vulnerabilities, resulting in patches released this week. Cloudflare reported millions of hacker attempts following the disclosure, though Barron noted no evidence of successful exploitation prior to the public announcement.
The rise of AI tools has significantly increased the volume of code change proposals, which are now nearly double compared to a year ago. However, the number of contributors has not grown proportionally, placing a heavy burden on the small team to review code and prevent new vulnerabilities.
Barron emphasized that the current funding model is insufficient for a project of such critical infrastructure importance. The situation underscores a broader issue in the open-source ecosystem where the scale of software usage by businesses and governments often lacks a corresponding level of financial and human resource support for maintenance.
