PHP's vital role in the web

The PHP programming language, despite its sometimes ungrateful reputation among developers, remains a cornerstone of the Internet. The discovery this week of two critical vulnerabilities has reminded people of PHP's significance in a stark manner. According to estimates reported by Reuters, PHP powers up to 70 percent of websites worldwide, operating behind the scenes of a multitude of content management systems (CMS) and online services, often without end users realizing its existence.

PHP Foundation's limited resources

The PHP Foundation, responsible for supporting the development of the language, has only one full-time employee and relies on fourteen developers and specialists who work mostly part-time. Its board of directors operates on a voluntary basis. The organization is described by its own director as underfunded, despite the growing workload.

Open-source challenges

The phenomenon of the "backseat passenger" is prevalent in the open-source world, where countless companies benefit from this technical foundation for free, often without directly supporting its maintainers financially. This dynamic has led to a situation where the creators of essential tools are not always adequately compensated for their work, even as their software powers major digital operations.

AI's impact on security and maintenance

The introduction of artificial intelligence has further complicated the situation. AI tools are increasingly used by security researchers to scrutinize code, sometimes uncovering vulnerabilities that have remained hidden for a decade. While this major cleanup should be excellent news for web security, it has caused a critical bottleneck. The automated search for bugs has led to an explosion in the number of patch proposals submitted to the project, a volume that has almost doubled in a very short time.

Struggle to keep up with demand

However, the human staff tasked with examining, testing, and validating these submissions remain desperately fixed in number. Artificial intelligence has industrialized the discovery of gaps, but the repair still rests on the shoulders of a handful of maintainers, who are still reluctant to be adequately funded by the giants of the digital world.