Two serious PHP flaws sent website operators rushing to patch in October 2026. In an Oct. 23 interview with Reuters, PHP Foundation executive director Elizabeth Barron described the nonprofit's staffing: “We have one full-time staff member (that's me) and 14 mostly part-time contractors.” Reuters reported that its board members are unpaid volunteers and that funding comes from donations and grants. The foundation helped coordinate fixes, including patches issued Oct. 21.
Barron said the PHP project was receiving nearly twice as many proposed code changes as a year earlier, “yet the number of contributors hasn't doubled.” Reviewing contributions and bug reports requires “a massive amount of human input and experience,” she told Reuters. Given how heavily companies and governments rely on PHP, Barron called it “incredibly under-funded.” Her staffing figures describe the foundation, not everyone who contributes to PHP.
In an Oct. 22 report for The New Stack, Steven J. Vaughan-Nichols wrote that some operators took services offline while waiting for fixes. That precaution did not mean those sites had been hacked. He also reported that the PHP Foundation called its delayed handling of an underlying issue “a structural failure” tied to decision-making and resources. The New Stack argued that open-source maintenance needs more resources; Kara Sprague, HackerOne's CEO, said in a statement quoted by the outlet that software supporting millions of websites cannot depend on a handful of maintainers.
Reuters reported that Cloudflare had seen millions of hacking attempts. Barron said the foundation had no evidence hackers exploited the vulnerabilities before disclosure or on sites that had been patched.
Comments