PHP Foundation Has Only One Full-Time Employee Coordinating Fixes for Two Major Vulnerabilities
Elizabeth Barron, Executive Director of the PHP Foundation, stated that the organization has only one full-time employee (herself) and 14 mostly part-time contractors, with board members serving as unpaid volunteers. Funding comes from donations and grants.
This week, the foundation coordinated the repair of two serious PHP vulnerabilities (collectively known as PHP2Shell, CVE-2026-109618 and CVE-2026-109619), which could lead to unauthenticated remote code execution. PHP may support up to 70% of websites globally, and some government websites in Europe temporarily went offline for emergency patches.
The foundation collaborated with external organizations such as OpenAI, Wiz, and Calif to investigate and release patches. Cloudflare reported millions of attack attempts, but the foundation stated there is no evidence that the vulnerabilities were exploited before being disclosed, or that patched systems were successfully exploited.
AI-related code contributions have doubled the foundation's workload, requiring extensive manual review. The foundation stated that due to the high reliance of businesses and governments on PHP, the project is "severely underfunded." Some public records indicate an annual budget of approximately $973,000.
Signs of a related vulnerability were discovered as early as 2024, but delays in handling due to resource and decision-making process issues were termed a structural failure by the foundation. The patch was released on Wednesday, and users are strongly advised to update immediately.
Regarding market mechanisms, global websites and government services rely on open-source foundational components, with maintenance costs borne by a few non-profit organizations and volunteer/part-time personnel. Beneficiaries are businesses and governments using PHP (receiving free security patches), while the burden falls on the resource-limited maintenance foundation, with funding gaps magnified during high-risk events.
Source: Public Information
ABAB AI Insight
The PHP Foundation was established in recent years to provide sustainable funding and development support for the PHP language, which has a history of 30 years. Historically, core maintenance has relied on volunteers and limited sponsorship. An external audit in 2024 found related signs but did not form a usable path, and delays in handling were termed a structural failure by the foundation.
In terms of capital pathways, funding mainly comes from corporate sponsorships and individual donations to pay for the security and maintenance work of a few contracted developers. In this incident, the foundation coordinated external security resources from OpenAI, Wiz, etc., to complete the patches, but its own full-time manpower is only one person, showing that maintenance capacity heavily relies on external cooperation and limited budgets.
This is similar to the situation faced by other critical open-source projects (such as some Linux distributions or early OpenSSL) that exposed funding and manpower shortages after major vulnerabilities. The current phase is a transition from a volunteer model to organized funding for open-source infrastructure, but core security still relies on limited dedicated resources.
Essentially, this is a restructuring of the industry chain. The underlying languages of the internet are maintained by small non-profit teams, while commercial and government users rely on them at scale; as AI accelerates vulnerability discovery and code contributions, the maintenance burden increases, putting pressure on the traditional "free use, volunteer maintenance" model, prompting a re-evaluation of sustainable funding and responsibility sharing.
ABAB News · Cognitive Laws
Free infrastructure, the cost is risk delay
Dependence breadth determines impact, funding depth determines response
Vulnerability disclosure accelerates patches, resource shortages extend windows