The nonprofit foundation that supports PHP, the three-decade-old programming language that may underpin up to 70 percent of websites globally, operates on one full-time staff member and 14 mostly part-time contractors, its executive director told Reuters in an interview published October 23. “We have one full-time staff member (that’s me) and 14 mostly part-time contractors,” said Elizabeth Barron, the PHP Foundation’s executive director. Board members are unpaid volunteers, and the foundation’s funding comes from donations and grants.
A shoestring budget behind critical infrastructure
The disclosure came in the same week that two serious flaws in PHP set off a global scramble to patch websites. The flaws had been present for about a decade before AI-assisted research found them. Barron said the foundation works with outside researchers and companies, including OpenAI and cybersecurity firms Wiz and Calif, to investigate security flaws and coordinate fixes — including the patches released this week. Cloudflare has reported millions of hacking attempts against the flaws, but Barron said the foundation had no evidence hackers exploited the vulnerabilities before they were disclosed, or on sites that have been patched.
“We received no further indication from OpenAI, Wiz or Calif, with whom we’re working closely on this issue, regarding any issues on patched systems,” Barron said. The patches went out this week after the flaws, which had been present for about a decade, were found with AI assistance.
AI doubles the workload, not the workforce
Artificial intelligence has proved both a help and a burden to the foundation, Barron said. It helped researchers find the decade-old flaws, and it has made programmers more efficient. But it is also increasing maintainers’ workloads: the PHP project is receiving nearly twice as many proposed code changes as a year ago, “yet the number of contributors hasn’t doubled,” she said. Reviewing contributions and bug reports requires “a massive amount of human input and experience”. The dynamic is familiar across open source: AI writes more code, and humans must still read all of it.
“Given that reliance, it is clear that PHP is incredibly under-funded,” Barron said, pointing to how heavily companies and governments rely on the language.
Why It Matters
The numbers tell the story of open-source sustainability in miniature. A language running most of the web’s sites is maintained by the equivalent of a small startup’s staff, funded by donations, while AI tools flood it with twice the code to review. Every AI-assisted vulnerability discovery — like the PHP flaws found this week, or the agentic attacks Unit 42 caught hitting PHP servers — adds review work that only experienced humans can do. The security of the web now depends on a review pipeline that AI is widening at both ends: more flaws found, more code submitted, and the same handful of people in the middle.
The pattern is not unique to PHP. The same week brought the Brotli decoder flaw OpenAI’s red team disclosed, another case of critical infrastructure maintained by a thin bench. The question Barron raises is whether the companies whose businesses depend on these projects will fund the humans who keep them safe.
Background
PHP has powered the web for three decades, from WordPress sites to major web platforms. The foundation that funds its development operates as a nonprofit supported by corporate sponsors and individual donations — a model common across open-source infrastructure, and one that strains every time a critical flaw reminds the industry how much depends on how few maintainers. From Log4Shell to this week’s PHP patches, the pattern is the same: the internet’s load-bearing code is kept standing by a skeleton crew.
Source: Reuters
0 Comments