PHP Runs Most of the Web on One Full Time Salary
The two serious PHP flaws that forced companies and governments to scramble this week have a quieter story behind them, and it is about money. The nonprofit that maintains the language, which may underpin as much as 70 per cent of the world's websites, has one full time employee.
Elizabeth Barron, executive director of the PHP Foundation, told Reuters that she is the foundation's one full time member of staff, alongside 14 contractors who mostly work part time. Board members are unpaid volunteers, and the operation runs on donations and grants, which means the people fixing a global language are largely doing it around other jobs and other commitments.
And that is the entire permanent capacity behind a three decade old language that sits under a large share of the internet, from small sites to government portals. The gap between that footprint and the payroll is the point Barron was making when she said the project is, in her words, incredibly short of funding given how much the world now relies on it.
And the fix work is coordinated rather than owned. The foundation works with outside researchers and companies, including OpenAI and the security firms Wiz and Calif, to investigate flaws and line up patches, which is how the repairs for the two flaws reached users this week. Barron said Cloudflare had reported millions of hacking attempts against the vulnerabilities, while adding that the foundation had no evidence hackers exploited them before disclosure or succeeded against patched systems.
The flaws had been present for a decade, and artificial intelligence helped researchers find them. Barron credits AI with making programmers more efficient, which sounds like good news for a small team until you follow it through.
But the same tools have increased the load on maintainers. The project is receiving nearly twice as many proposed code changes as it did a year ago, while the number of contributors has not doubled, so the review queue has grown faster than the capacity to clear it. Checking contributions and bug reports, Barron said, still needs a large amount of human input and experience, because a patch that looks tidy can still be wrong in ways a reviewer has to recognise.
So the economics are inverted. AI lowers the cost of producing code, and raises the cost of accepting it, and the bill lands on the volunteers and the single salaried director at the end of the pipeline. A tool that helps attackers and helpers alike does not fund the people who decide what ships.
This is not unique to PHP. The same pattern runs through the open source components that modern software is assembled from, where a handful of maintainers carry critical infrastructure with no commercial relationship to the companies that depend on them. What makes this case vivid is the ratio, one paid person against a language on most of the web.
So the foundation's answer is not new either, which is that companies benefiting from the work should fund it. Whether this week's scramble changes any budgets is the question worth watching, and the answer will not come from the patch notes.
The PHP Foundation has one full time employee, its executive director, plus 14 contractors who mostly work part time.
PHP may underpin up to 70 per cent of websites worldwide, according to the report.
Two serious flaws found this week had been present for a decade and required coordinated fixes.
AI helped find the flaws and speeds up coding, but proposed code changes have nearly doubled against flat contributor numbers.
Barron said there was no evidence of exploitation before disclosure or on patched systems.
Source: Reuters
