From BigGo Finance · BigGo Finance · · 1m 40s
PHP Foundation Runs on One Employee Amid Security Crisis
PHP Foundation patches critical flaws but admits underfunding as security crisis exposes funding gap.
In brief
PHP Foundation patches critical flaws but admits underfunding as security crisis exposes funding gap. PHP Foundation patched two critical security flaws but admits it operates with one full-time employee and 14 contractors amid funding gaps. Originally reported by BigGo Finance.
PHP Foundation Staff
The PHP Foundation operates with one full-time employee and 14 mostly part-time contractors.
Security Crisis
The foundation patched two critical memory-safety flaws, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell.
Third Flaw
A third flaw, CVE-2026-115560, requires a very unlikely configuration and code combination to exploit.
Funding Gap
The foundation is 'incredibly under-funded' given PHP's widespread use across 70% of websites with server-side languages.
Security Response
CISA urged immediate patching, and the NSA advised offline for sites that couldn't update quickly.
Global Impact
Dutch, Finnish, and French government sites went offline as a precaution, with 1.3 million hosts potentially vulnerable.
AI's Role
AI helped find flaws but nearly doubled code changes without matching contributor growth.
Resource Strain
The security team has published 15 CVEs and worked through over 100 invalid reports since July 1.
Structural Risk
The foundation admitted resourcing, not technical difficulty, caused delays in fixing critical flaws.
Expert Warning
Mandiant's Charles Carmakal noted exploitation may have begun in limited fashion despite no widespread success.
Immediate Action
Companies must patch the two critical fixes immediately and consider configuration changes for the third flaw.
Long-Term Challenge
The open-source ecosystem faces structural risks as AI-driven vulnerability hunting outpaces funding and contributions.
The bottom line
PHP Foundation patched two critical security flaws but admits it operates with one full-time employee and 14 contractors amid funding gaps.
