PHP Foundation Sees Donations Rise After October Security Updates

The PHP Foundation saw receipts in its public dollar ledger climb after PHP’s Oct. 21 security updates, highlighting the funding needed to protect a programming language used across much of the web.

As of Oct. 29, PHP was used by 69.2% of websites whose server-side programming language could be identified. PHP released updates for two vulnerabilities that could allow remote code execution. Such flaws can let an attacker run code on an affected system from a distance.

Receipts rose sharply after the updates. Monthly spending was about $100,000 from June through Oct. 29, with October’s period incomplete. Executive Director Elizabeth Barron said Oct. 23 that the foundation has no fixed income and relies on donations and grants.

In an Oct. 23 interview, Barron said she was the foundation’s only full-time employee and that it had 14 contractors, most part time. The foundation also lists Ben Marks as Director (Fundraising), without specifying his employment status. Barron said board members are unpaid.

Barron said PHP code proposals were close to twice their year-earlier level, while contributor numbers had not doubled. Reviewing code and security reports still requires people with relevant experience. AI tools can help check and group reports, but people assess issues and review patches.

Since July 1, PHP’s security team has published 15 CVEs and closed more than 100 reports classified as invalid, duplicate or not reproducible. The foundation formed its Ecosystem Security Team in May; Alexandre Daubois joined in July to help handle reports, and Daniel Scherzer joined in September to strengthen security.

The foundation is seeking ongoing support from companies that build products with PHP, hosting and cloud providers, distributions that deliver PHP, and governments. Germany’s Sovereign Tech Agency funded a 2024 security audit organized through OSTIF and conducted by Quarkslab.