Open-Source Funding Shortages
The inrush of software vulnerability reports over the last year has highlighted how many critical pieces of open-source software are chronically underfunded. The latest victim is PHP, the scripting language powering about 71% of websites, making the news due to a critical remote code execution vulnerability. The PHP Foundation, which develops and oversees the language, reportedly counts only one full-time person and 14 mostly part-time contractors, while the broader problem goes far deeper due to administrative practices.
In an interview with Reuters, the PHP Foundation's Executive Director Elizabeth Barron explained that she is the only full-time employee, working alongside a team of contractors. The core team develops and maintains the PHP core, including security fixes, and accepts contributions from the global developer community in an arrangement similar to Linux kernel development.
The development team was stretched thin even before the increase in security vulnerabilities aided by automated AI agents. Barron noted that there was no reported exploitation before the security fix was released.
Vulnerability Resolution Delays
A lack of higher funding levels likely led to structural delays in addressing the underlying vulnerability. The out-of-memory condition that eventually led to exploits was originally discovered in 2024, and work on fixing the problem stalled and restarted repeatedly over months given the widespread nature of PHP and its third-party extensions.
The team acknowledged that foundation funding made it possible to have multiple people work on the issue full-time, including through weekends, to coordinate with involved parties.
Legacy Software Risks
The issue extends beyond core language bugs, as servers running the current 8.x branch should theoretically be upgraded quickly with released patches. Instead, many websites went down for hours or days out of fear of exploitation.
Nearly 73% of PHP installations were running versions well past their end-of-life date, making it significantly harder to obtain fixes despite long-standing warnings from industry professionals.
Many servers were still running PHP 7, which reached end-of-life years ago, while a smaller percentage continued running version 5.x, leaving systems vulnerable long after official support ended.
Upgrading and Modernization
While transitioning between major PHP versions requires modifying sections of code, most required changes involve straightforward syntax updates and dropping support for deprecated functions that had received years of advance notice.
The persistence of outdated installations illustrates how maintenance delays and legacy debt remain significant challenges for enterprise web infrastructure.
