# PHP Foundation Runs on One Employee Amid Security Crisis

> PHP Foundation patches critical flaws but admits underfunding as security crisis exposes funding gap.
- Title: PHP Foundation Runs on One Employee Amid Security Crisis
- Summary: PHP Foundation patches critical flaws but admits underfunding as security crisis exposes funding gap. PHP Foundation patched two critical security flaws but…
- Keywords: php foundation, php2shell, cve-2026-109618, cve-2026-109619, cve-2026-115560, openai, wiz, calif, mandiant, charles carmakal, php security, open-source
- Source: BigGo Finance — https://finance.biggo.com/news/d0493227-7e97-4bfa-8337-33d7ddf2eea3
- Author: BigGo Finance
- Published: 2026-10-23T22:25:13+00:00
- Read time: 1 min
- Topics: php foundation, php2shell, cve-2026-109618, cve-2026-109619, cve-2026-115560, openai, wiz, calif, mandiant, charles carmakal, php security, open-source
## PHP Foundation Staff
The PHP Foundation operates with one full-time employee and 14 mostly part-time contractors.
## Security Crisis
The foundation patched two critical memory-safety flaws, CVE-2026-109618 and CVE-2026-109619, known as PHP2Shell.
## Third Flaw
A third flaw, CVE-2026-115560, requires a very unlikely configuration and code combination to exploit.
## Funding Gap
The foundation is 'incredibly under-funded' given PHP's widespread use across 70% of websites with server-side languages.
## Security Response
CISA urged immediate patching, and the NSA advised offline for sites that couldn't update quickly.
## Global Impact
Dutch, Finnish, and French government sites went offline as a precaution, with 1.3 million hosts potentially vulnerable.
## AI's Role
AI helped find flaws but nearly doubled code changes without matching contributor growth.
## Resource Strain
The security team has published 15 CVEs and worked through over 100 invalid reports since July 1.
## Structural Risk
The foundation admitted resourcing, not technical difficulty, caused delays in fixing critical flaws.
## Expert Warning
Mandiant's Charles Carmakal noted exploitation may have begun in limited fashion despite no widespread success.
## Immediate Action
Companies must patch the two critical fixes immediately and consider configuration changes for the third flaw.
## Long-Term Challenge
The open-source ecosystem faces structural risks as AI-driven vulnerability hunting outpaces funding and contributions.
## Key takeaway

PHP Foundation patched two critical security flaws but admits it operates with one full-time employee and 14 contractors amid funding gaps.