An estimated 70 per cent of websites worldwide rely on PHP, yet the non-profit foundation responsible for supporting its development operates with limited financial resources.
By Frank Ulom
·
Published on October 24, 2026
·
3 min read
The PHP Foundation has raised concerns about inadequate funding and limited staffing after two high-severity vulnerabilities in PHP triggered an urgent global effort to protect websites from cyberattacks.
The incident has highlighted the importance of the open-source programming language, which has been in use for about 30 years and powers a significant proportion of the internet.
An estimated 70 per cent of websites worldwide rely on PHP, yet the non-profit foundation responsible for supporting its development operates with limited financial resources.
Elizabeth Barron, executive director of the PHP Foundation, disclosed in an email interview on Friday that the organisation has only one full-time employee, herself, alongside 14 contractors, most of whom work part-time.
“We have only one full-time employee, which is me, and another 14 contractors, most of whom are part-time,” Barron said.
The foundation’s board members serve as unpaid volunteers, while its operations depend on donations and grants.
According to IT Home, the foundation collaborated with external researchers and several companies, including OpenAI and cybersecurity firms Wiz and Calif, to investigate the vulnerabilities and coordinate the development of security patches.
The fixes released on Wednesday were the result of this collaboration.
Millions of Attack Attempts Detected
Cybersecurity services provider Cloudflare reported detecting millions of attempted attacks following the disclosure of the vulnerabilities.
However, Barron said the foundation had no evidence that hackers had successfully exploited the flaws before they became public or attacked websites that had already installed the patches.
“We are working closely with OpenAI, Wiz and Calif on this issue, and none of these organisations has reported any anomalies in systems that have already been patched,” she said.
The incident has demonstrated the importance of collaboration between open-source maintainers, security researchers and technology companies in identifying vulnerabilities and protecting internet infrastructure.
Artificial Intelligence Increases Workload for PHP Maintainers
Artificial intelligence has become both a benefit and a challenge for the PHP Foundation.
The vulnerabilities, which had remained undetected for a decade, were discovered with the assistance of AI, highlighting the technology’s potential to improve software security.
Barron also acknowledged that AI had increased programmers’ productivity.
However, the technology has simultaneously increased the workload facing maintainers. The PHP project now receives nearly twice as many code change proposals as it did a year ago, but the number of contributors has not increased at the same rate.
Reviewing code submissions and vulnerability reports requires considerable human effort and experienced judgement, placing additional pressure on the people responsible for maintaining the programming language.
The growing volume of submissions has therefore created a challenge for a foundation with limited full-time staffing and financial resources.
PHP Foundation Calls for Greater Financial Support
Barron said the recent security incident demonstrated the extent to which businesses and governments depend on PHP.
Given its widespread use across the internet, she argued that the resources allocated to maintaining the programming language were insufficient.
“Given how heavily everyone relies on it, it is obvious that PHP is severely underfunded,” she said.
The foundation’s concerns highlight the challenges facing open-source projects whose technologies underpin critical internet services but whose maintenance often depends on donations, grants and contributions from a relatively small community.
As AI-assisted security research increases the volume of vulnerabilities and code changes identified, the PHP Foundation faces the task of sustaining security reviews and development with limited resources, despite the programming language’s extensive use worldwide.
