The situation of 'director and employee' at PHP organization

Many companies and governments around the world had to rush to update security patches related to the PHP programming language after two PHP2Shell vulnerabilities were made public on October 21. This situation shows the importance of the open source programming language created more than 30 years ago to the global Internet.

However, the PHP Foundation, a non-profit organization established to support, promote and ensure the long-term sustainable development of this programming language, is operating with a limited budget and personnel.

"We only have one full-time employee, which is me, and 14 part-time contractors," PHP Foundation Executive Director Elizabeth Barron said on October 23.

Board members are all unpaid volunteers, while funding comes from donations and sponsorships.

The PHP Foundation has collaborated with many researchers and businesses, including OpenAI and Google's cybersecurity company Wiz, to investigate the security vulnerability and develop a fix.

Cloudflare company announced that it had detected millions of cyber attack attempts after information about the vulnerability appeared, but Director Barron affirmed that there is no evidence that hackers have taken advantage of this weakness before. "We have not seen any issues on the patched system," she said.

Barron said AI is both a help and a burden to the PHP Foundation. AI agents help researchers find vulnerabilities that have existed for more than 10 years and increase the productivity of programmers, but also increase the burden on those in charge of maintenance.

The number of code change proposals submitted to the PHP Foundation was nearly double that of last year, but the number of contributors did not increase. "Evaluating change proposals and reporting errors requires large amounts of data from people, as well as their experience," said the Director of the PHP Foundation.

Barron said that the events of the past few days show that governments and businesses still rely heavily on PHP. "In that context, it can be clearly seen that the PHP Foundation is lacking both human resources and budget," she said.

Diep Anh (According to Reuters)