- The PHP Foundation runs on about $974,000 a year, per its Open Collective page.
- The foundation has one full-time employee, Executive Director Elizabeth Barron, plus 14 mostly part-time contractors.
- Proposed code changes to PHP have close to doubled in a year, Barron said.
The PHP Foundation runs on about $974,000 a year, with one full-time employee looking after a language behind most of the web.
Two critical PHP flaws sparked a worldwide patching frenzy this week.
One full-timer and 14 contractors keep the language going
“We have one full-time staff member (that’s me) and 14 mostly part-time contractors,” Executive Director Elizabeth Barron said Friday in an interview. The board of the foundation is unpaid, and the money comes from grants and donations.
The foundation’s Open Collective page shows its yearly budget as $974,057.80. The foundation has raised $3.06 million since its launch in late 2021, spending $2.70 million.
With that budget, the $356,614.52 left over will cover expenses for four months. It shows that 1,927 people have donated and that 340 people have made monthly pledges worth ~$9,416 in total.
Barron said that in a year, the proposed changes to PHP code have almost doubled, and contributors have not kept up. Every submission and bug report still needs to be checked out by real people with experience.
AI helped researchers detect the two flaws that had been in the PHP code for a decade, and it makes programmers faster, Barron said.
AI also adds review burden to maintainers. She called the programming language badly underfunded, given how much companies and governments rely on PHP.
Barron saw no sign hackers got into patched sites
Since December 2021, Automattic is the biggest backer at $762,500. JetBrains at $476,670.
Sovereign Tech Fund is at ~$214,115. The Linux Foundation is at $183,500.
Smaller amounts are supplied by Private Packagist, Craft CMS, Cybozu, and Tideways. Zend by Perforce has given $56,000 and GoDaddy $48,000.
Chainguard Team has contributed $50,000 since October 21, the day PHP released its patches.
The foundation states on the page that it pays developers to work on the PHP language.
The largest tagged expense category is core developer work. It took 227 payments totaling ~$1.11 million out of 526 paid expenses.
PHP issued patches for CVE-2026-109618 and CVE-2026-109619 on October 21, both with a severity rating of 9.2 out of 10, Cryptopolitan reported. The pair, dubbed PHP2Shell, could allow attackers to execute code without logging in.
Wiz showed the flaws can also spill passwords and API keys from memory. PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 are the fixed releases.
Cloudflare registered millions of exploit attempts, and the government websites in Finland, the Netherlands and France went offline temporarily. The foundation works with OpenAI, Wiz and Calif to fix things.
Barron said there was no evidence hackers exploited the flaws prior to their disclosure or on patched sites.
This open-source language, which is over 30 years old, is employed on 69.3% of websites where the server-side language is known.
The smartest crypto minds already read our newsletter. Want in? Join them.
FAQs
How much does the PHP Foundation run on each year?
The foundation's estimated yearly budget is $974,057.80, according to its Open Collective page.
Who funds the PHP Foundation?
Donations and grants fund it, with Automattic the largest backer at $762,500.
Why is the PHP Foundation calling itself under-funded now?
Proposed code changes have close to doubled in a year, Barron said, while the number of contributors has not.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Randa Moses
Randa Moses is an editor and reporter at Cryptopolitan covering tech, AI, robotics, crypto, scams, and hacks. She has worked in the crypto space since 2017. She held roles at Forward Protocol, AmaZix, and Cryptosomniac. Randa holds a degree in Electrical and Electronics Engineering from the University of Bradford.
