PHP's Skeleton Crew Exposes the Funding Crisis Behind the Web's Most Ubiquitous Language
A critical vulnerability in PHP has laid bare the precarious state of the open-source project that runs nearly three-quarters of all websites, with just one full-time employee managing the entire foundation.
Complacency remains one of the internet's most dangerous adversaries. Over the past year, an uptick in automated vulnerability discovery has exposed a troubling pattern: many foundational open-source projects operate on shoestring budgets. PHP, the scripting language that underpins roughly 71% of websites globally, recently became the latest casualty when a critical remote code execution flaw surfaced. The PHP Foundation, responsible for stewarding the language's development, operates with minimal staffing: a single full-time employee supported by 14 contractors working mostly on a part-time basis. Yet this skeletal structure merely scratches the surface of a deeper systemic problem rooted in how the internet builds and maintains its infrastructure.
Elizabeth Barron, Executive Director of the PHP Foundation, laid out the situation plainly in remarks to Reuters: "she's the only full-time person on staff, and works with the contractors' help." The foundation's core mission encompasses developing and maintaining PHP's foundation code, with particular emphasis on addressing security vulnerabilities. Like the Linux kernel project, PHP accepts patches and contributions from the broader developer community. However, the comparison underscores a critical disparity: Linux benefits from numerous full-time contributors and engineers employed by major corporations, whereas PHP's team operates at a fraction of that scale.