PHP Foundation Runs With 1 Full-Time Staffer as 2 Critical Flaws Trigger Global Patching
Updated
Updated · Reuters · Oct 23
PHP Foundation Runs With 1 Full-Time Staffer as 2 Critical Flaws Trigger Global Patching
3 articles · Updated · Reuters · Oct 23
Summary
One full-time employee and 14 mostly part-time contractors are supporting the PHP Foundation as it coordinates fixes after two critical vulnerabilities sent website operators worldwide rushing to patch systems.
Barron said the nonprofit, funded by donations and grants, works with OpenAI, Wiz and Calif on flaw research and Wednesday’s patches, underscoring how a language used by up to 70% of websites relies on a thin support structure.
Millions of hacking attempts have been reported by Cloudflare, but the foundation said it has seen no evidence the flaws were exploited before disclosure or on systems already patched.
AI helped researchers uncover the decade-old bugs, yet it has also nearly doubled incoming code changes over the past year without a matching rise in contributors, increasing review pressure on maintainers.
The episode exposed how heavily governments and companies depend on the 30-year-old open-source language, which Barron said remains “incredibly under-funded.”