The PHP Foundation struggles to raise enough funds to sustain one of the most widely used programming languages for web applications.
Despite PHP’s role as the foundation for an estimated 70% of all websites, the foundation has only one full-time employee. The growing use of AI-generated code is putting additional pressure on developers, Reuters reports.
The funding issue surfaced last week after researchers discovered two critical vulnerabilities in the language. The vulnerabilities, which had gone undetected for about a decade, forced website administrators worldwide to install emergency patches.
The PHP Foundation relies on donations and grants to carry out its work. Executive Director Elizabeth Barron is the only permanent employee. She is supported by 14 freelancers, most of whom work part-time.
AI creates more work
The rise of AI is increasing the pressure on the foundation’s limited resources. Although AI lets developers write code faster, it also creates extra work for those who maintain open-source projects. The foundation received nearly double the proposed code changes last year, while the number of developers tasked with reviewing them did not increase.
Last week’s security incident highlighted the consequences of this imbalance. Two vulnerabilities left website administrators uncertain. Many websites were taken offline until the patches were installed.
The foundation collaborated with external security researchers and companies, including OpenAI, Wiz, and Calif, to investigate the vulnerabilities and develop patches. AI-assisted research also helped discover the vulnerabilities.
Immediately after the foundation disclosed the vulnerabilities, Cloudflare reported millions of hacker attempts to exploit them. However, the PHP Foundation found no evidence that attackers had exploited the vulnerabilities before disclosure. Barron also noted that research partners had no evidence pointing to successful attacks against systems that had been patched.
The incident exposed structural problems at the PHP Foundation. Organizations worldwide depend on PHP’s ongoing development and security. However, relatively few resources support the people who maintain PHP.