The Language Behind 70 Percent of Websites Is Guarded by One Full-Time Employee and 14 Contractors, PHP Foundation Director Says

Two critical vulnerabilities in PHP set off a global patching scramble this week, with government websites across Europe briefly going dark and Cloudflare reporting millions of exploitation attempts. The episode showcased how much of the internet still runs on the three-decade-old language, which may underpin up to 70 percent of sites worldwide. It also exposed something less visible: the nonprofit foundation that maintains PHP operates on what its own director calls a shoestring budget.

We have one full-time staff member, that is me, and 14 mostly part-time contractors, executive director Elizabeth Barron told Reuters in an email interview on Friday. Board members are unpaid volunteers, and funding comes entirely from donations and grants. The foundation, which coordinates development of a language that powers a large share of the web, works with outside researchers and companies including OpenAI and the security firms Wiz and Calif to investigate flaws and coordinate fixes.

On the security question itself, Barron offered reassurance. Despite Cloudflare logging millions of hacking attempts after disclosure, she said the foundation had received no indication from OpenAI, Wiz or Calif of the flaws being exploited before they were disclosed, or on systems that had applied the patches. The two bugs, found with AI assistance, had been present in the codebase for roughly a decade before discovery.

Artificial intelligence has proved both a help and a burden to the project, Barron said. It helped researchers find the long-lived flaws and has made programmers more efficient. But it is also inflating the review workload: the PHP project is receiving nearly twice as many proposed code changes as a year ago, yet the number of contributors has not doubled. Reviewing contributions and bug reports, she noted, requires a massive amount of human input and experience, the one resource the foundation does not have.

The disclosure process itself wobbled. Per the foundation's own post mortem, the two CVE identifiers began circulating on forums and social media on October 20, two days before the targeted release. One of the reporting security firms then mistakenly published a video showing its proof of concept against real targets, and copies spread quickly. On October 21, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo by publishing built images containing the fix, letting potential attackers study the patch in binary form while every other PHP user was still waiting.

The foundation did not sugarcoat the internal review. In its blog post, it acknowledged that the delay in fixing the bugs, first spotted in 2024 with work stalling and restarting over months, was a structural failure caused by both the security team's decision process and its lack of resources. The team has since begun changing its processes so decisions can be made by majority vote, and says it is prioritizing faster handling of similarly complex fixes.

Wednesday's patch, the foundation wrote, shows progress in how PHP security is handled, but the funding ask was unusually direct: the project needs more knowledgeable engineers and a properly resourced security team, and it can only achieve that with funding from the organizations that depend on PHP. Given that companies and governments run payroll, banking and public services on the language, Barron said, it is clear that PHP is incredibly under-funded.

The PHP episode is the open-source maintenance crisis in miniature, now accelerated by AI. Models find decade-old bugs in days and generate patches at machine speed, while the human side of the pipeline, the triage, the review, the coordinated disclosure across dozens of distributors, still runs on one director, fourteen contractors and a donation page. The industry has spent two years worrying whether AI would flood the world with malware. This week suggests a more immediate problem: it is flooding maintainers with work that nobody is paying for, on infrastructure that everybody uses.