PHP Foundation runs on one full-time employee amid security crisis
Elizabeth Barron, the foundation's secretary general, says support for PHP is far too small compared with how many sites depend on it.
The PHP Foundation, the non-profit that supports the widely used PHP programming language, is run by a single full-time employee, its secretary general Elizabeth Barron said, as two serious security vulnerabilities in PHP forced emergency patching at websites worldwide. Reuters reported the staffing situation.
Barron said she is the foundation's only full-time employee and works with 14 mostly part-time contractors, while board members serve as unpaid volunteers. The organisation runs on donations and grants.
The two flaws prompted emergency responses this week. European government websites blocked access on October 21 to apply patches, according to the facts of the case. The foundation coordinated its investigation and fixes with outside researchers and companies including OpenAI, Wiz and Cloudflare, and the patch released on October 21 came out of that process.
Cloudflare detected millions of hacking attempts, but Barron said there is no evidence that hackers exploited the flaws before disclosure or on patched sites. AI researchers involved in the review found bugs that had been hidden for 10 years.
Reviewers lag behind proposals
Code change proposals submitted to the PHP project have nearly doubled from a year earlier, while the number of reviewers has not grown accordingly, Barron said. She said the incident showed how much companies and governments depend on PHP, and that support for the language is far too small in comparison.
Quick answers
What happened to PHP this week?
Two serious security vulnerabilities were found in PHP, prompting emergency patching at websites worldwide. European government websites blocked access on October 21 to apply patches.
Who maintains the PHP Foundation?
Secretary General Elizabeth Barron said she is the only full-time employee and works with 14 mostly part-time contractors. Board members are unpaid volunteers, and the foundation operates on donations and grants.
Were the PHP flaws exploited by hackers?
Cloudflare detected millions of hacking attempts, but Barron said there is no evidence hackers exploited the flaws before disclosure or on patched sites.