GoKawiilPHP Flaw Fixes Expose Thin Staffing Behind Web's Core Software
Following last week's discovery of two major PHP vulnerabilities by a team using an OpenAI model, engineers worldwide rushed to patch websites, with some European government sites temporarily going offline during updates. Reuters reports that the PHP Foundation, the nonprofit responsible for coordinating security fixes for the software powering roughly 70% of websites, has only one full-time staff member, Executive Director Elizabeth Barron, supported by about 14 part-time contractors.
GoKawiil's interpretation of the reporting above, not reported fact.
The incident suggests that much of the web's infrastructure relies on volunteer-driven, underfunded organizations to manage security for widely used but aging code. Because no law requires website owners to update PHP, and many sites are poorly maintained or abandoned, vulnerabilities could persist long after patches are released, leaving data breaches and liability risks in their wake. This could prompt renewed calls for better funding or oversight of open-source infrastructure critical to the internet's operation.
- Two major PHP vulnerabilities were found last week by a team using an OpenAI model, prompting urgent patches.
- The PHP Foundation, tasked with coordinating security for the software, has only one full-time employee and limited resources.
- No legal requirement forces website owners to update PHP, leaving many sites exposed despite available fixes.
Source: cnet.com — Omar Gallaga, 2026-10-27
Published there as: “Last Week’s Critical PHP Warning Was the Tip of the Web Vulnerability Iceberg”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.