The 'Director-Employee' Situation at the PHP Foundation

A small team under heavy pressure

The PHP Foundation is a non-profit group. It helps develop and protect PHP, a free programming language. After two security holes, called PHP2Shell, were made public on October 21, many companies and governments had to quickly install security fixes. The foundation's chief executive, Elizabeth Barron, said the group has only one full-time worker, herself, and 14 part-time contractors. Its leaders are unpaid volunteers. The group depends on donations and sponsorships for money.

Key facts

• PHP runs about 70% of websites around the world.
• The PHP Foundation has 1 full-time employee and 14 part-time contractors.
• The number of proposed code changes sent to the foundation is almost double last year's number.
• The number of people who contribute code has not grown.
• Cloudflare said it found millions of attack attempts after the flaws became known.

Why PHP matters

PHP is an open-source language, which means anyone can read and use its code for free. It was created more than 30 years ago and is a core part of the internet. The foundation works with researchers and companies, including OpenAI and Google's security company Wiz, to study the flaws and build fixes.

Why this matters

Many websites depend on PHP, so weak support can put many users at risk. AI tools help find old bugs and make programmers faster, but they also add more work for the people who maintain the code. Barron says the foundation needs both more people and more money.

What to watch

• Whether attackers used the PHP2Shell flaws before fixes were installed.
• Whether the foundation gets more staff or funding.
• Whether more people start helping to review code changes and report bugs.