Lack of staff and funding likely led to the recent PHP security snafu; project has only one full-time employee, but that's just the tip of the iceberg
Lack of funding likely led to the recent PHP security snafu, but that's just the tip of the iceberg — dreary situation caused by services running old versions with no support
The PHP scripting language, which powers a significant portion of websites, has been plagued by a critical remote code execution vulnerability. The PHP Foundation, responsible for developing and maintaining PHP, operates with a meager workforce - just one full-time employee and 14 part-time contractors. This staffing issue, coupled with outdated development practices, has contributed to the project's inability to address security flaws in a timely manner.
Elizabeth Barron, the PHP Foundation's Executive Director, explained that the team's job involves developing and maintaining the PHP core and handling security fixes. The core team accepts contributions from the public, similar to the approach taken by the Linux kernel, but with fewer resources. Despite collaboration with other companies and cybersecurity firms, the team's workload has been stretched thin, especially with the surge in security vulnerabilities aided by AI agents.
One of the major problems is the widespread use of outdated PHP versions. Nearly 73% of PHP installations are running versions past their end-of-life, making it difficult to obtain necessary fixes. Many servers are still using PHP 7, a version that was officially discontinued four years ago. Additionally, around 7.7% of PHP sites are still using version 5.x, which was officially discontinued 22 years ago.
The team acknowledges that the lack of higher funding likely contributed to the structural failure in addressing the vulnerability. The "out-of-memory" condition (OOM) that led to the 2026 exploits was first discovered in 2024, and the work on fixing the issue has stalled and restarted repeatedly over the months. The Chainguard security firm accidentally broke the PHP2Shell embargo, which further complicated the situation.
Despite the funding challenges, the team is grateful for the support it has received. They have managed to work around the clock, including weekends, to coordinate and communicate with other parties. However, this incident highlights the larger issue of complacency and cost-cutting practices in the industry. The real problem extends beyond just bugs in the core language, as nearly 73% of PHP installations are running outdated versions, making it harder to apply fixes.
In theory, websites running the current version of PHP should be able to upgrade in minutes with the released patches. However, in reality, websites have gone down for hours or days out of fear of exploitation. The major issue lies in the fact that 73% of PHP installations are running versions that are no longer supported, making it challenging to obtain necessary updates.
The widespread use of outdated PHP versions, combined with complacency and cost-cutting practices, has allowed the collective complacency to reach a dangerous point. The team emphasizes that there was ample time for preparation, as many warnings about the impending issues were issued years ago. The ease of upgrading from PHP 5 to 8, despite requiring changes to website code, suggests that the situation could have been mitigated with proper planning and resource allocation.
Written by urgent.news from Tom's Hardware's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
