PHP Foundation Has Only One Full-Time Employee, Director Says

The PHP Foundation says it operates with just one full-time employee and 14 part-time contractors, days after coordinating fixes for two serious flaws in the language that powers much of the web, including Brazilian services.

Editor's note: this article specifically cites e-commerce sites, news portals, bank and government back-ends, as well as WordPress and Laravel installations in Brazil as affected by the PHP flaws. This direct association with Brazil is an extrapolation by the editorial team based on PHP's widely known use in the country; it does not appear in the Reuters/Economic Times report used as a source, which does not mention Brazil or specific sectors. The remaining data and quotes in the article (the PHP Foundation's structure, statements from Elizabeth Barron, partners involved, percentage of sites running PHP) are confirmed by the original source.

The PHP Foundation says it operates with just one full-time employee and 14 part-time contractors, days after coordinating fixes for two serious flaws in the language that powers much of the web, including Brazilian services.

Two Flaws That Stopped the Week

This week, security researchers discovered two serious flaws in PHP, the language that has underpinned a significant share of web infrastructure for more than three decades. The fixes were published on Wednesday, October 21, 2026, after a global rush to protect websites before the vulnerabilities could be exploited at scale, according to a Reuters report published by Economic Times.

The episode reignited an uncomfortable question for those who depend on the language: who, in fact, keeps PHP running? The answer, given by the PHP Foundation's own executive director, Elizabeth Barron, exposes a wide gap between the language's importance and the size of the team that maintains it.

One Foundation, One Employee, 14 Contractors

In an email interview given on Friday, Barron described the real structure behind the project.

We have one full-time staff member (that's me) and 14 mostly part-time contractors.

Elizabeth Barron, executive director of the PHP Foundation

Besides the single paid full-time employee, the foundation's board is made up of unpaid volunteers. Funding comes from donations and grants, with no recurring revenue of its own. It was this lean structure that coordinated, together with outside researchers, the investigation into the two flaws fixed last Wednesday.

Among the partners mentioned by Barron are OpenAI and the cybersecurity firms Wiz and Calif, which worked alongside the foundation to identify and document the vulnerabilities before the patches were publicly disclosed.

What Is (and Isn't) Known About Exploitation

Cloudflare recorded millions of attack attempts against PHP sites since the flaws became public, according to the report. Despite the volume of attempts, Barron says the foundation has no evidence that the bugs were successfully exploited before disclosure, nor in systems that have already received the fixes.

We received no further indication from OpenAI, Wiz or Calif, with whom we're working closely on this issue, regarding any issues on patched systems.

Elizabeth Barron, executive director of the PHP Foundation

AI Helps Find Bugs, But Also Grows the Backlog

The two flaws fixed on Wednesday had been present in PHP's code for about a decade, according to Barron. Artificial intelligence tools played a direct role in the discovery: they helped researchers find the vulnerabilities and, according to the director, made programmers more productive in the day-to-day maintenance of the project.

The flip side is the volume of work that falls on those who maintain the code. The PHP project now receives almost twice as many code change proposals as it did a year ago, but the number of contributors hasn't grown at the same pace, according to Barron. Reviewing every contribution and every bug report, in practice, requires human time and expertise that the foundation doesn't have in sufficient supply.

What This Means for Those Running PHP in Brazil

The foundation estimates that PHP is behind up to 70% of the world's websites, according to the report. In Brazil, its presence is just as widespread: e-commerce sites, news portals, internal back-ends at banks and government agencies, as well as the massive base of WordPress and Laravel installations, depend directly or indirectly on the runtime and the security fixes maintained by this lean structure.

For anyone running a PHP server in production, the case reinforces a practical lesson that's nothing new, but now backed by concrete figures: updating to the patched version isn't optional, it's part of the job of keeping the application secure. The team that investigates and fixes critical flaws in the language running your application is, today, made up of one full-time employee and 14 mostly part-time contractors, splitting this work with other jobs.

This also weighs into the risk calculation for those maintaining legacy systems on unsupported PHP versions. Without the patches produced by this foundation, defense against vulnerabilities like the ones discovered this week falls entirely on whoever manages the infrastructure, without the coordinated research network that helped identify and fix the current flaws.

The Paradox of Critical Dependence

Barron sums up the problem in one blunt sentence.

Given that reliance, it is clear that PHP is incredibly under-funded.

Elizabeth Barron, executive director of the PHP Foundation

The statement exposes a recurring pattern in critical open-source infrastructure: languages and libraries used by billions of applications depend, at the end of the chain, on a small group of people working with limited resources, a dynamic similar to the one that has already exposed projects like OpenSSL in previous ecosystem crises.

The report does not include, so far, any commitment to increased funding from the companies that rely on PHP at scale, nor a concrete plan to expand the foundation's team. For those who build and maintain PHP applications, including in Brazil, the question remains open: the infrastructure that fixes critical flaws in the language continues to be sustained, in practice, by a handful of people.