The PHP Foundation, the organization responsible for supporting the development of the PHP language, has only one full-time employee and 14 contracted professionals, most of them part-time. The structure was revealed by executive director Elizabeth Barron in an interview with Reuters published on Friday, the 23rd, amid the response to two critical security vulnerabilities.
“We have one full-time employee—me—and 14 contractors, most of them part-time,” said Barron. The organization also has a board made up of unpaid volunteers and relies on donations and grants to fund its activities.
The size of the team contrasts with the importance of PHP, a language used on a large portion of the world's websites. This does not mean, however, that only one person is responsible for maintaining the technology. Development of the language involves an international community of contributors, in addition to the professionals affiliated with the foundation.
Artificial intelligence increases pressure on PHP maintenance
The revelation comes after the disclosure of two critical vulnerabilities that led to the release of fixes on October 21. The flaws could allow remote code execution on servers under certain conditions. The foundation worked with researchers and outside companies to investigate the problems and coordinate the updates.
According to Barron, artificial intelligence helped researchers identify vulnerabilities that had existed for about a decade. However, the same technology is also increasing the maintenance workload.
The PHP project currently receives nearly twice as many proposed code changes as a year ago, while the number of contributors has not grown at the same rate. Evaluating these proposals and bug reports continues to require technical knowledge and human review.
Although Cloudflare recorded millions of attack attempts related to the recent flaws, Barron said there was no evidence of successful exploitation before the vulnerabilities were disclosed or in systems that had already been patched.
For the director, the dependence of companies and governments on PHP highlights an imbalance between the importance of the technology and the resources allocated to its maintenance. She described the language as extremely underfunded.
