One employee, fourteen contractors
The foundation that maintains PHP has one full-time member of staff. “We have one full-time staff member (that’s me) and 14 mostly part-time contractors,” executive director Elizabeth Barron told Reuters in an email interview published on Friday. Board members are unpaid volunteers, and the money comes from donations and grants.
That is the organisation standing behind a language Reuters says may underpin up to 70% of websites. Last week two critical remote code execution flaws in PHP sent operators across Europe scrambling to patch, and the flaws were found with help from AI systems run by OpenAI and the security firms Wiz and Calif.
“Given that reliance, it is clear that PHP is incredibly under-funded,” Barron said.
Twice the proposals, the same people
The more durable problem Barron described is not the emergency. It is volume. The PHP project is now receiving nearly twice as many proposed code changes as it was a year ago, she said, “yet the number of contributors hasn’t doubled.” Reviewing contributions and bug reports, she added, requires “a massive amount of human input and experience.”
The foundation’s own account of the release says the same thing from the inside. “The growth of AI-assisted research also means the PHP security team receives far more reports than before,” it wrote on 21 October. The team has published 15 CVEs since 1 July and worked through more than 100 reports that turned out to be invalid, duplicates or not reproducible.
AI is on both sides of that ledger. The foundation says it worked with Alpha-Omega to scan PHP with Anthropic’s Claude Mythos, and has since added OpenAI’s Daybreak Red for validating reports and exploits. It also says the vulnerabilities fixed last week had been in the engine for about a decade.
What the tools cannot do
The foundation is explicit about where the bottleneck sits. “AI helps the team validate reports and group reports sharing the same root cause, but a person makes every call and works on every patch,” it wrote.
“Tools now find bugs faster than ever, for defenders and attackers alike, and the number of reports will keep growing,” the post continued. “What tools cannot do is decide on the right fix for a long-standing design decision in the engine, weigh the compatibility trade-offs, and review the patch.”
That is not a hypothetical. The foundation says a fix for the underlying memory problem stalled and restarted repeatedly over months because the security team could not choose between approaches that each broke something, and called the delay “a structural failure, caused by both the security team’s decision process and its lack of resources.”
What to watch
Barron said the foundation has no evidence attackers exploited the flaws before disclosure, or on systems that have been patched. “We received no further indication from OpenAI, Wiz or Calif, with whom we’re working closely on this issue, regarding any issues on patched systems,” she said. Cloudflare has reported millions of attempts.
The foundation has turned the episode into a fundraising argument, asking companies, hosting providers and governments to sponsor it at a level reflecting their dependence, and pointing to the German Sovereign Tech Agency’s funding of PHP’s 2024 audit as the model. Whether any of them answer is the thing to watch — the asymmetry Barron describes gets worse as the tools get better.
