Business · Companies · 2 hrs ago
PHP Foundation says it is under-funded with one full-time employee
The PHP Foundation has one full-time employee and 14 mostly part-time contractors supporting the programming language.
PHP may underpin up to 70% of websites worldwide, making it important to businesses and governments.
Two serious flaws led to security fixes on Oct.
21, after the vulnerabilities had been present for a decade.
The foundation worked with outside researchers and companies, including OpenAI and cybersecurity firms Wiz and Calif, to investigate and coordinate the fixes.
The foundation has no evidence hackers exploited the flaws before they were disclosed or on sites that had installed the fixes.
AI helped researchers find the flaws, but it is also adding to maintainers’ workload.
Code-change proposals have nearly doubled in a year, while the number of contributors has not, and the foundation says its reliance on donations and grants leaves it under-funded.
The PHP Foundation has one full-time employee and 14 contractors, most of them part-time, executive director Elizabeth Barron said.
Barron said the foundation is under-funded despite the reliance of companies and governments on PHP.
The foundation works with outside researchers and companies including OpenAI, Wiz and Calif to investigate security flaws and coordinate fixes.
Two serious PHP flaws were discovered this week, and patches were issued on Oct. 21.
Barron said the foundation had no evidence that hackers exploited the flaws before disclosure or on sites that had been patched.
Artificial intelligence helped researchers find the flaws but has also increased maintainers’ workloads.
- Who
- The PHP Foundation, whose executive director is Elizabeth Barron.
- What
- Barron said the foundation has one full-time employee and 14 mostly part-time contractors, and is under-funded.
- When
- Barron spoke in an email interview on Oct. 23, 2026.
- Where
- Not stated
- Why
- Barron said companies and governments rely on PHP, while the foundation’s funding comes from donations and grants.
This story does not have two clearly opposing sides.
The two flaws were present in PHP, Barron said.
Patches for the flaws were issued.
Barron gave an email interview about the foundation’s staffing, funding and work on the flaws.
- Full-time staff
- 1, including Barron
- Contractors
- 14, mostly part-time
- PHP sites
- May underpin up to 70% of sites globally
- Patch date
- Oct. 21, 2026
- Code-change proposals
- Nearly twice as many as a year earlier
2 sources
What people are saying
We have one full-time staff member (that’s me) and 14 mostly part-time contractors
Given that reliance, it is clear that PHP is incredibly under-funded.
We received no further indication from OpenAI, Wiz or Calif, with whom we’re working closely on this issue, regarding any issues on patched systems
yet the number of contributors hasn’t doubled