PHP is used by nearly 70% of websites, but the foundation that supports the development of the programming language has only one full-time employee and 14 part-time contractors. After the recent discovery of two critical vulnerabilities, the question has been raised again whether developers have enough resources to protect this part of the internet.
PHP is used by nearly 70% of websites, but the foundation that supports the development of the programming language has only one full-time employee and 14 part-time contractors. After the recent discovery of two critical vulnerabilities, the question has been raised again whether developers have enough resources to protect this part of the internet.
PHP Foundation Director Elizabeth Barron told Reuters about the lack of funding. According to her, the foundation exists thanks to donations and grants, and board members work without a salary.
She says the workload on the team is only increasing. AI tools have made it easier to find potential vulnerabilities, so more and more reports of problems are coming in. But the same small team has to review them and prepare fixes.
The PHP2Shell story showed how difficult this work can be. Previously, dev.ua wrote that hackers began attacking critical vulnerabilities four days before the official patches were released. And the memory problem that ultimately led to the appearance of these vulnerabilities was noticed by developers back in 2024.
However, fixing it proved to be a challenge, as developers had to find a solution that wouldn't break websites and applications, and also take into account the numerous third-party PHP extensions. As a result, work on the fix was repeatedly halted and resumed. The PHP Foundation admitted that the delay was also due to a lack of resources and organizational difficulties.
But even timely updates do not guarantee the security of sites. After all, there is another problem - resource owners who have been using outdated versions of PHP for years.
According to W3Techs, about 27% of PHP sites still use the seventh version of the language, support for which ended in 2022. Another approximately 8% work on PHP 5. This version appeared more than 20 years ago, and the last official security updates for it were released back in 2018.
Site owners on current versions of PHP can install released patches. Those who still use older versions have to upgrade to newer ones or look for alternative methods of protection.
As Tom's Hardware notes, migrating to a new version sometimes requires changes to the site's code. However, tools that help automate this process have been around for years.
Earlier, dev.ua wrote that after the discovery of critical vulnerabilities in PHP, Node.js developers also released urgent patches for 10 vulnerabilities. The most dangerous of them allows attackers to remotely run malicious code on servers.
