PHP Foundation executive director Elizabeth Barron has spoken openly about the organization's money problems. She is its only full-time employee, 14 more specialists work mostly part-time, and the board serves without pay.
Meanwhile, by her estimate, up to 70% of the world's websites may run on PHP. The foundation lives on donations and grants alone, and that is no longer enough for the growing workload.
Workload grows faster than the contributor base
Over the past year the number of code change proposals to PHP has nearly doubled, while the number of contributors stayed flat. Every patch and every bug report has to be reviewed by hand, which takes a lot of time from experienced engineers. AI tools are part of the reason: they help find vulnerabilities, but also create more work for the people triaging the findings.
The PHP2Shell connection
The statement follows the PHP2Shell critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619), which could allow remote code execution. To find and fix them, the foundation worked with OpenAI and the security firms Wiz and Calif. Releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 shipped, along with patches for the unsupported 7.4, 8.0 and 8.1 branches. Another flaw, CVE-2026-115560, only triggers with rare non-default settings, and details are promised after the next releases.
What the foundation plans
The PHP Foundation wants to hire more qualified engineers and give its security group proper resources. It is counting on companies whose business depends on PHP: given that dependence, Barron says, the language is catastrophically underfunded.
Commentary
For owners of sites built on WordPress, Laravel and other PHP stacks, the practical takeaway is simple: install security updates as soon as they ship, and plan to move old branches such as 7.4 and 8.0 to current versions. Patches for outdated branches are an exception right now, and with so few people available it is unwise to count on them.
Source: Habr.