CONNECT WITH US
Tech

Tech

Lack of staff and funding likely led to the recent PHP security snafu; project has only one full-time employee, but that's just the tip of the iceberg

Tom's Hardware logo

Published on

Add as a preferred source on Google
Lack of staff and funding likely led to the recent PHP security snafu; project has only one full-time employee, but that's just the tip of the iceberg

The AI-powered inrush of software vulnerability reports over the last year has shined a light on how many critical pieces of open-source software are chronically underfunded. The latest victim is PHP, the scripting language powering about 71% of websites, making the news due to a critical remote code execution vulnerability. The PHP Foundation, which develops and oversees the language, reportedly counts only one full-time person and 14 "mostly part-time" contractors. That's bad enough, but the real problem goes far deeper thanks to the internet's lazy development practices and systems administration.

In an interview with Reuters, the PHP Foundation's Executive Director Elizabeth Barron spells it out clearly: she's the only full-time person on staff, and works with the contractors' help. Pertaining to the software itself, the team's job is to develop and maintain the PHP core, including taking care of security fixes. The core team accepts contributions from the world at large, in an arrangement not too dissimilar to Linux kernel development — except that project is far better-manned, with many full-time contributors and company-employed developers.

Naturally, the PHP foundation collaborates with other companies and many cybersecurity firms, but the dev team was stretched thin even before the increase in security vulnerabilities with the help of countless AI agents. Barron does note that there was no reported exploitation of PHP2Shell before the security fix came out.

But the lack of a higher funding level likely led to the "structural failure" to address the underlying vulnerability in a timely manner, as the out-of-memory condition (OOM) that eventually led to the 2026 exploits was originally discovered in 2024.


Source link
Related Topics:Tech

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.