PHP Foundation 'under-funded' with one full-time staff member, director says

The PHP Foundation, which supports the open-source programming language used by up to 70% of global websites, is operating on a very limited budget, according to its Executive Director Elizabeth Barron. The foundation has only one full-time staff member and 14 part-time contractors. Funding comes from donations and grants, with board members serving as unpaid volunteers.

Recently, two serious flaws in PHP were discovered, prompting a global effort to secure websites from potential hackers. While the foundation works with various researchers and companies, including OpenAI and cybersecurity firms Wiz and Calif, to investigate the security issues and coordinate fixes, there is no evidence that hackers were able to exploit these vulnerabilities before they were disclosed or on patched systems.

Barron stated that the foundation received no further indications from OpenAI, Wiz, or Calif about issues on patched systems. The discovery of these flaws highlights the critical role PHP plays in the internet's security. However, the foundation faces challenges due to AI advancements, which have helped researchers find the flaws but also increased the workload of maintainers. The number of proposed code changes has nearly doubled in the past year, despite the contributor base not doubling.

The PHP project is receiving more code changes than ever before, but the foundation is struggling to keep up with the demand for human input and experience required to review contributions and bug reports. Barron emphasized that given the heavy reliance of companies and governments on PHP, it is clear that the programming language is severely under-funded.