PHP Foundation Director: Organization Operates With One Full-Time Employee, Funding Falls Short

Two serious flaws discovered in PHP this week have triggered a global security alert and once again shown how important the open-source programming language , which has existed for thirty years , really is .

The discovery of two serious security vulnerabilities in PHP has set off a worldwide effort to protect websites from hackers . Meanwhile , the nonprofit foundation that develops PHP, which powers up to 70% of websites worldwide , operates on a very limited budget .

PHP Foundation Executive Director Elizabeth Barron said in an email interview on Friday that the organization has just one full-time employee , herself . In addition , it has 14 contractors , most of whom work part-time . Board members are unpaid volunteers , and funding comes from donations and grants .

To investigate the flaws and coordinate fixes , the foundation is working with outside researchers and companies , including OpenAI and the cybersecurity firms Wiz and Calif . Patches were released on Wednesday .

Although the web security company Cloudflare reported millions of attack attempts , Barron said the foundation has no evidence that hackers were able to exploit the vulnerabilities before disclosure or on patched sites .

“We have not received any further information about problems with patched systems from OpenAI, Wiz or Calif , with whom we have worked closely on this matter ,” she said .

According to Barron , artificial intelligence has proven to be both a help and an added burden for the foundation . The technology has helped researchers find flaws that have existed for a decade , and it also makes programmers more efficient .

At the same time , the workload of technical staff has grown . The PHP project is receiving roughly twice as many proposed code changes as a year ago , but the number of contributors has not doubled . Barron noted that reviewing proposals and bug reports requires a great deal of human contribution and expertise .

In the director’s view , recent events have shown how heavily companies and governments depend on PHP.

“ Given this reliance , it is clear that PHP is incredibly underfunded ,” Barron stressed .