The PHP Foundation admitted that weak internal processes and scarce resources delayed fixes for two critical vulnerabilities in PHP, the programming language that may support up to 70 percent of websites worldwide. The foundation called the delay a ‘structural failure.’
The episode renewed pressure on governments, technology firms and web platforms that depend on PHP but contribute little to its upkeep. It also shows how a small nonprofit can become a single point of failure for much of the internet.
PHP Foundation Executive Director Elizabeth Barron said the organisation has only one full-time employee—herself—and 14 mostly part-time contractors. Its board members work unpaid, while donations and grants fund its operations.
That structure looks fragile for software with such global reach. The foundation received about EUR 736,000 from roughly 500 donors. The foundation said a researcher first flagged signs of one vulnerability in 2024. At the time, it saw no clear way to exploit the issue, so other security problems took priority.
The two flaws, now called PHP2Shell, can allow unauthenticated remote code execution under certain conditions. Both carry a severity score of 9.2 out of 10.
PHP released emergency updates on October 21 for versions 8.2, 8.3, 8.4 and 8.5. The patches arrived after vulnerability details became public, forcing companies and governments to move quickly.
The foundation said PHP security still depends on a small group of funded developers, and there are too few of them. The problem is not a shortage of warnings; it is a shortage of people able to act on them.
Without steady funding and larger security teams, critical projects will remain exposed to delayed fixes, rushed patches and avoidable disruptions. The PHP Foundation has patched the immediate flaw, but the structural gap remains.
Also Read: PM Modi Inaugurates RBI Data Centre and Cybersecurity Institute in Odisha