Business

PHP’s Security Role Highlights Strain on Underfunded Maintainers

The PHP Foundation coordinated fixes for two critical vulnerabilities while operating with a small paid team, limited funding and a growing review burden.

jajoy39

Oct 24, 2026 - 12:15

Oct 24, 2026 - 12:22

0 1

PHP’s Security Role Highlights Strain on Underfunded Maintainers

A small organization behind a widely used project

The PHP Foundation’s response to two critical vulnerabilities this week has also exposed the financial pressure behind maintaining one of the web’s most established programming languages.

Executive Director Elizabeth Barron told Reuters in an interview that the foundation has one full-time staff member—herself—and 14 mostly part-time contractors. Its board members are unpaid volunteers, while funding comes from donations and grants. Barron said the foundation is “incredibly under-funded” given the reliance of companies and governments on PHP.

The staffing figure is a current interview detail reported by Reuters, not a claim that every PHP contributor is employed by the foundation. The foundation’s 2025 Impact and Transparency Report said that, at the end of 2025, it had an executive director sponsored by JetBrains and 11 contracted developers working part- and full-time; it listed 11 foundation developers as of Jan. 1, 2026.

Funding supports maintenance, but demand is rising

The foundation’s report said sponsors and individual donors contributed $730,534 in 2025. It reported $645,191 received after fees and $784,376 in expenses, alongside support from 536 organizations and individuals. The report said the money funded work on core language development, bug and security fixes, release management and other maintenance.

That work is becoming harder to absorb. Barron told Reuters that artificial intelligence helped researchers find the flaws and made programmers more efficient, but the project is receiving nearly twice as many proposed code changes as a year earlier while its contributor count has not doubled. Reviewing code and bug reports still requires substantial human judgment and experience.

Two critical flaws sharpen the stakes

PHP’s official Oct. 21 release announcement said PHP 8.3.36 fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which could allow unauthenticated remote code execution. The announcement urged PHP 8.3 users to upgrade and said updating was the only safe choice.

Reuters reported that the foundation worked with OpenAI and cybersecurity firms Wiz and Calif on the response. Cloudflare observed millions of attempts, but Barron said the foundation had no evidence of successful exploitation before disclosure or on patched systems. Attempts are not evidence that an attack succeeded.

The episode therefore points to a broader infrastructure issue: emergency security coordination depends on maintainers whose resources remain modest compared with the importance of the software they support.