PHP Foundation Says It Runs on One Full

The organization that maintains the programming language behind a large of the world's websites has a staff of one. Elizabeth Barron, executive director of the PHP Foundation, said the nonprofit runs with a single full-time employee -- herself -- plus 14 mostly part-time contractors, while its board members serve without pay.

"Given that reliance, it is clear that PHP is incredibly under-funded," Barron said in an email interview, referring to the dependence of companies and governments on the three-decade-old open-source language. Funding comes from donations and grants. Public financial records for the foundation list an estimated annual budget of $973,000.

The disclosure landed in the middle of a severe security week for PHP. On Wednesday the foundation published patches for two memory-safety flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and collectively nicknamed PHP2Shell, that could allow attackers to take over servers. Security researchers and the foundation have described mass scanning and exploitation attempts since the fixes went out, though no successful compromise has been publicly confirmed. Both flaws carry a CVSS v4.0 score of 9.2, in the critical range. The CVE identifiers had circulated a day before the release with an incorrect score of 10.0, and the project moved the release up from October 22 to October 21 after the leak.

The response was global. CISA urged organizations to patch immediately, and the NSA advised sites that could not update quickly to consider going offline. The Dutch government portal Overheid.nl, all Finnish government public-facing services and the French Interior Ministry's websites were taken offline as a precaution, and some Canadian government sites followed. Security researcher Silas Cutler estimated that more than 1.3 million internet-exposed hosts were potentially vulnerable, while a Shodan by Henk Poley counted more than 1.9 million hosts running PHP. Amazon's threat intelligence unit said it had logged an exploitation attempt against its honeypot network on October 17, four days before disclosure, though it did not know whether the attempt would have worked on a real system.

A third flaw, CVE-2026-115560, surfaced on Friday. Barron said it requires "a very unlikely combination of configuration and specific PHP application code, which we do not expect to occur in practical use of PHP," and can be mitigated with a configuration setting. The foundation published an informational advisory rather than an emergency patch, and a full fix is slated for the regular release. The advisory recommends disabling the session upload progress feature until then. The Wednesday releases do not fix it.

Updating is the only complete fix, the security team says. The fixed releases are 8.5.12, 8.4.27, 8.3.36 and 8.2.35; PHP 7.4 through 8.1 received source patches only, and branches from 5.4 through 7.3 are end-of-life with no fix. Where updating is not immediately possible, the advisory lists configuration changes that reduce exposure to specific attack paths, but warns they do not make an installation safe, and every PHP worker must be restarted afterwards.

Note: Website is an estimate cited by the foundation and security researchers; W3Techs put the figure at 69.3% in October 2026.

The foundation has been coordinating with outside researchers and companies, including OpenAI and the cybersecurity firms Wiz and Calif, on the investigation and the fixes. Barron said the foundation has no evidence that attackers successfully exploited the two Wednesday vulnerabilities before disclosure, or on systems that have been patched. "We received no further indication from OpenAI, Wiz or Calif, with whom we're working closely on this issue, regarding any issues on patched systems," she said.

The disruption reached Japan within hours. Codmon, a daycare SaaS platform, the game Shadowverse: Worlds Beyond, e-commerce service BASE and Sakura Internet's rental server went into emergency maintenance or announced overnight downtime, with Shadowverse and BASE among the operators confirming PHP was the cause. Japan's National Cybersecurity Office urged PHP users to update as soon as possible.

Artificial intelligence has cut both ways for the project. Tooling helped researchers uncover the two long-dormant flaws, and Barron said it has made programmers more productive. But the volume of proposed code changes has nearly doubled from a year earlier while the pool of contributors has not, leaving a small group to review a growing pile of patches and bug reports -- work she said demands "a massive amount of human input and experience."

The foundation has since acknowledged that resourcing, not only technical difficulty, drove the delay. The OOM flaw behind CVE-2026-109618 was first spotted in 2024 during the project's first external security audit in years, but competing fixes each broke backward compatibility, created denial-of-service risk or required coordinated changes across third-party extensions, and work stalled and restarted for months. "We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources," the foundation wrote in a post published with the patches. The load shows in the report queue as well: since July 1 the security team has published 15 CVEs and worked through more than 100 reports that turned out to be invalid, duplicates or not reproducible, with a person still making every call and writing every patch.

The threat picture remains unsettled. Charles Carmakal, chief technology officer at Mandiant, which is owned by Google Cloud along with Wiz, wrote in a post on Friday that there is no evidence of successful wide-scale exploitation but that the risk is real: "exploitation may have already begun in a limited fashion and the threat is viable and very serious." He noted that several proof-of-concept exploits are circulating publicly, many of them apparently AI-generated and incapable of remote code execution, though some validated samples can achieve it against default mod_php deployments, just not PHP-FPM.

For companies running PHP, the immediate takeaway is patch discipline: the two Wednesday fixes should already be applied, and administrators of exposed systems may want to weigh the configuration change for the third. For the open-source ecosystem, the episode raises a harder question. A language embedded in a majority of the web is maintained by a handful of people funded by donations, and the surge in AI-assisted vulnerability hunting and code submission is adding load faster than contributions or money are arriving. That imbalance is the kind of structural risk that shows up only when something breaks.