The PHP Foundation’s staffing has become part of the story around last week’s PHP security emergency. Reuters reported on October 23 that Executive Director Elizabeth Barron said the nonprofit has one full-time staff member, herself, and 14 mostly part-time contractors. Its board members are unpaid volunteers, and its funding comes from donations and grants.
The security timing made the staffing number harder to ignore
The Reuters interview followed PHP’s October 21 security releases for PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP.net said those releases fixed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that can allow unauthenticated remote code execution. PHP.net said all PHP installations serving web requests were at risk, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed, with risk highest for mod_php.
The PHP Foundation’s own security post said the vulnerabilities touched memory management and error handling, parts of PHP used by nearly every request. The foundation said reports from Calif, OpenAI and Wiz made the full impact of the out-of-memory issue clear, and that from August 11 onward, fixing it became the top priority for the foundation team working on security.
The official PHP advisory also warned that PHP 8.1 and older no longer receive routine updates from the PHP project, although some distributions and long-term support vendors may provide backported fixes. For these vulnerabilities, the PHP security team also provided minimal source backports for PHP 7.4, 8.0 and 8.1. For companies using operating-system packages, managed hosting or older application stacks, the visible PHP version number is not always the whole maintenance story.
AI is adding pressure, not removing humans from the process
Barron told Reuters that artificial intelligence has been both useful and burdensome for the project. Reuters reported that AI helped researchers find the flaws and made programmers more efficient, while the PHP project is receiving nearly twice as many proposed code changes as a year earlier and the number of contributors has not doubled.
The foundation’s October 14 security team post describes the same pressure from the maintainer side. Since July 1, the team said it had published 15 CVEs and closed 106 reports that were not vulnerabilities, duplicates or not reproducible. The post said AI tools help validate reports and group related issues, but “every verdict is made by a person.”
That is the maintenance bottleneck now visible across many open-source projects. Tools can generate reports faster, and researchers can test more code paths, but experienced maintainers still have to reproduce issues, judge severity, preserve compatibility, write fixes and coordinate releases.
The foundation’s financial report shows strain without suggesting insolvency
The PHP Foundation’s May 2026 impact and transparency report said sponsors and donors contributed US$730,534 in 2025. After fees, including the Open Source Collective fiscal-host fee and payment processing fees, the foundation received $645,191 and spent $784,376.
The foundation described the roughly $139,000 difference as a deliberate choice to maintain investment in technical headcount while sponsor and donor relationships were being strengthened. It also said the foundation remained financially solvent with healthy reserves and that reducing the difference was a 2026 priority.
The same report said the foundation ended 2025 with eight volunteer board members, an executive director sponsored by JetBrains and 11 contracted developers working part- and full-time. It credited the team with work on PHP 8.5, PIE 1.0, stream-layer modernization and roughly 42% of all commits to PHP’s core in 2025.
Grant-funded security work is helping, but it is not the same as broad funding
The foundation has added targeted security capacity this year. In May, it announced an Alpha-Omega grant to create a PHP Ecosystem Security Team and fund a six-month full-time “Ecosystem AI Security Engineer in Residence” role. In September, it said Daniel Scherzer had joined the ecosystem security team on a short-term basis under the same grant to handle PHP hardening issues that do not qualify as security vulnerabilities.
That funding matters, but it is also targeted. It does not replace steady general funding for core development, release management, infrastructure, review work and the slow maintenance tasks that rarely become headlines until something breaks.
What the staffing disclosure means for PHP users
W3Techs measured PHP at 69.2% of websites whose server-side programming language it could identify on October 26, 2026. The denominator is narrower than “all websites”: W3Techs is measuring sites where the server-side language is known.
The staffing disclosure is not a reason to treat PHP as unusually fragile. It is a reminder that widely used open-source infrastructure often depends on a small number of paid maintainers, contractors and volunteers.
For businesses running PHP, the immediate operational lesson is to apply current security updates or confirm vendor backports, and review PHP.net’s follow-up advisories. On October 23, PHP advised temporarily disabling session upload progress to address an unlikely remote code execution path involving an unusual session-handler configuration. On October 26, it released updated Windows packages with a Brotli security fix; those packages retain the same PHP runtime version numbers.
The longer-term business lesson is broader. Open-source maintenance is part of operational risk, not a side issue separate from hosting, uptime or security budgets.
I can suggest related Tech Help Canada articles based on the topic you’re reading now.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
