PHP Powering 70% of Web Has Just One Full-Time Employee 2026

PHP powers approximately 70% of the web, yet the foundation behind it has just one full-time employee, according to a Reuters report. This startling fact came to light after two critical vulnerabilities forced a frantic race to protect millions of websites. The incident raises serious questions about the sustainability of the open-source software that underpins our digital lives.

The Shocking Staffing Reality of the PHP Foundation

Elizabeth Barron, the foundation's executive director, is the sole full-time employee. She oversees a team of 14 contractors, most of whom work part-time. The board is entirely voluntary, and funding comes from donations and grants. This precarious setup is a far cry from what you'd expect for software that runs on seven out of every ten websites.

PHP's ubiquity means that any vulnerability can have cascading effects across the internet. Yet the resources dedicated to maintaining it are minimal. The foundation's lean structure is a testament to the dedication of its contributors, but it also highlights a systemic risk.

Timeline of a Crisis: How the Vulnerabilities Unfolded

The problems date back to 2024, when the foundation identified one of the vulnerabilities during a security review. At the time, no known exploitation path existed, and fixing it was complex. Fast forward to 2026, and the vulnerability was discovered externally. Cybersecurity firm Calif alerted the team on August 11, OpenAI independently found it, and Wiz informed the foundation on August 24 after five days of investigation.

On October 20, the identifiers of both flaws were leaked, prompting the project to publish details a day early. The sequence of events underscores the challenges of coordinating disclosure when multiple parties are involved and resources are stretched thin.

Why This Matters for Website Owners and Developers

If you run a website on PHP—and chances are you do—this story affects you directly. The foundation's limited capacity means that critical security patches may take longer to develop and release. It also means that proactive security reviews are harder to conduct, increasing the window of exposure.

For businesses, a breach can lead to data loss, reputational damage, and financial penalties. For individual developers, it's a reminder to stay vigilant about updates and to consider contributing back to the projects they rely on.

Key Takeaways for the PHP Community

• Resource disparity: PHP's massive footprint contrasts sharply with its tiny full-time staff.
• Security risks: Limited resources can delay vulnerability fixes and increase exposure.
• Funding challenges: Reliance on donations and grants leaves the foundation vulnerable to financial instability.
• Community role: Users and companies benefiting from PHP should consider contributing financially or through code.
• Disclosure complexity: Coordinating with multiple security firms adds pressure to an already stretched team.

Comparing PHP's Support Model to Other Open-Source Projects

Many open-source projects struggle with funding, but PHP's scale makes its situation particularly concerning. The table below contrasts PHP's support structure with other critical infrastructure projects. Context on how this played out before sits in PHP Powering 70% of Web Has Just One Full-Time Employee.

While OpenSSL and jQuery also have lean teams, PHP's combination of massive usage and minimal staffing is a standout risk. The Linux kernel, by contrast, benefits from substantial corporate backing. The background to this story is set out in HR Karen Writes Toxic Dress Code Overnight, Employee Follows It To Full Extent And Make Her Regret. A related thread runs through Seth Meyers Slams Trump's Unpopularity: 'Madam Web Has Higher.

What to Watch Next: Funding, Security, and Community Response

The PHP Foundation needs sustainable funding to hire more full-time staff and improve security processes. Companies that depend on PHP should step up their contributions, whether financial or in-kind. The recent vulnerabilities may serve as a wake-up call for the industry. Earlier coverage in Technology: latest articles shows how the argument developed. A closer look at the same subject appears in Oura Ring 4 Review: Four Months of Wearable Health Tracking.

In the meantime, website owners should ensure their PHP installations are up to date and monitor for security advisories. The foundation's transparency about its limitations is commendable, but it's up to the broader community to ensure PHP's future remains secure. Anyone following the wider picture can start with Germany's Train Punctuality Crisis: 400 Stranded in Tunnel. The same theme surfaces in Ukraine's Plan to Tax Porn to Fund 30,000 Combat Drones, which takes a different angle.