PHP Foundation 'under-funded' with one full-time staff member, director says 

· CNA · Join
PHP code is displayed on a computer in Guernica, Spain, October 22, 2026. Government websites across Europe went dark on October 21, as operators raced to patch two critical vulnerabilities in PHP, one of the most widely used programming languages on the web. REUTERS/Vincent West
A photo illustration shows the <?php tag taken from the official PHP website, on a computer screen, in Ronda, Spain, October 22, 2026. Government websites across Europe went dark on October 21 as operators raced to patch critical vulnerabilities in PHP, one of the most widely used programming languages on the web. Photo taken using the reverse lens technique. REUTERS/Jon Nazca
Security advisory is displayed at the PHP website on a computer in Guernica, Spain, October 22, 2026. Government websites across Europe went dark on October 21, as operators raced to patch two critical vulnerabilities in PHP, one of the most widely used programming languages on the web. REUTERS/Vincent West

Read a summary of this article on FAST.
Get bite-sized news via a new
cards interface. Give it a try.
Click here to return to FAST Tap here to return to FAST
FAST

AMSTERDAM, Oct 23 : The discovery of two serious flaws in PHP this week set off a global scramble to keep websites safe from hackers, showing just how critical the three-decade-old open-source programming language is to the internet.

Yet the nonprofit foundation that supports PHP,  which may underpin up to 70 per cent of sites globally, operates on a shoestring budget. 

“We have one full-time staff member (that's me) and 14 mostly part-time contractors,” Executive Director Elizabeth Barron of the PHP Foundation said via email in an interview on Friday. Board members are unpaid volunteers, and funding comes from donations and grants.

The foundation works with outside researchers and companies, including OpenAI and cybersecurity firms Wiz and Calif, to investigate security flaws and coordinate fixes, including Wednesday's patches.

CNA Games

Guess Word
Crack the word, one row at a time

Buzzword
Create words using the given letters

Mini Sudoku
Tiny puzzle, mighty brain teaser

Mini Crossword
Small grid, big challenge

Word Search
Spot as many words as you can
 Show More
Show Less

While Web security company Cloudflare has reported millions of hacking attempts, Barron said the foundation had no evidence hackers were able to exploit the vulnerabilities before they were disclosed, or on sites that have been patched.

"We received no further indication from OpenAI, Wiz or Calif, with whom we're working closely on this issue, regarding any issues on patched systems,” she said.

Artificial intelligence has proved both a help and a burden to the foundation. It helped researchers find the flaws, which had been present for a decade, and Barron said it made programmers more efficient.

However, it is also increasing maintainers' workloads. The PHP project is receiving nearly twice as many proposed code changes as a year ago, “yet the number of contributors hasn't doubled,” she said. Reviewing contributions and bug reports requires “a massive amount of human input and experience.”

Recent events have shown how heavily companies and governments rely on PHP, Barron said.

“Given that reliance, it is clear that PHP is incredibly under-funded.”

Source: Reuters

Newsletter

Week in Review

Subscribe to our Chief Editor’s Week in Review

Our chief editor shares analysis and picks of the week's biggest news every Saturday.

Sign up for our newsletters

Get our pick of top stories and thought-provoking articles in your inbox

Subscribe here

Get the CNA app

Stay updated with notifications for breaking news and our best stories

Download here

Get WhatsApp alerts

Join our channel for the top reads for the day on your preferred chat app

Join here