Months of stops and starts on a PHP out-of-memory fix exposed gaps in the nonprofit’s security process, while PHP Foundation Executive Director Elizabeth Barron told Reuters it has one full-time staff member.
Barron told Reuters on Friday, Oct. 23, that the Foundation also has 14 contractors, most of whom work part time. She said its board members are unpaid volunteers, its funding comes from donations and grants, and available funding is inadequate. Barron also said proposed code changes had nearly doubled from a year earlier while the contributor count had not, leaving people to review changes and bug reports.
The PHP project released fixes on Wednesday, Oct. 21, for two critical vulnerabilities that could allow unauthenticated attackers to execute code remotely. The release covered versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
The Foundation says early clues to the out-of-memory problem surfaced as a core developer addressed an issue raised by a 2024 external security audit. It says developers revisited possible fixes over several months, weighing effects on backward compatibility, performance and third-party extensions. The Foundation also cited a small pool of people with deep knowledge of PHP’s code. It called the delay a structural failure and said it has begun changing how its security team makes decisions.
The Foundation said its security team had published 15 CVEs since July 1, 2026, and processed more than 100 reports that were invalid, duplicates or could not be reproduced. The organization said those reports still required human assessment.
W3Techs reported on Oct. 24 that PHP was used by 69.3% of websites for which it could identify a server-side programming language. The figure does not cover every website. In its report published in March 2025, the Foundation recorded $683,550 in donations and investments in 2024, with support from 658 organizations and individuals. It planned to spend up to $900,000 in 2025 and identified sustainable sponsorship as a challenge. The Foundation says companies, hosting providers, cloud platforms, software distributions and governments that rely on PHP can support its work through sponsorship.
A separate PHP advisory on Oct. 23 flagged an unlikely remote-code-execution scenario involving an unusual combination of session settings and application code. It recommended disabling session upload progress until the next regular bug-fix release, when the full advisory is due. The archive gives no date for that release; PHP 8.2 is scheduled to reach end of life on Dec. 31, 2026.
