PHP Foundation Funding: One Full-Time Staffer Runs PHP
The PHP Foundation has one full-time employee and about 14 part-time contractors. Here is how its funding works, what the numbers say, and what to do about it.
7 min read · Last updated: October 25, 2026
The PHP Foundation, the nonprofit that pays for core PHP development, has one full-time staff member: its executive director, Elizabeth Barron. She told Reuters on October 23, 2026 that the foundation also relies on 14 mostly part-time contractors, and that PHP is "incredibly under-funded" given how much companies and governments depend on it.
Came here from Instagram, LinkedIn, X or YouTube? Here is the full source list you came for. Everything below is built from these, nothing else.
The news
- Reuters via The Star, "PHP Foundation 'under-funded' with one full-time staff member, director says", Oct 24, 2026
- Hacker News discussion, Oct 2026
The foundation's own numbers
The security advisory
Secondary coverage
Key takeaways
- The PHP Foundation has 1 full-time staff member and 14 mostly part-time contractors, according to its executive director.
- In 2025 it received $645,191 after fees and spent $784,376, a gap of about $139,000.
- Sponsors and individual donors fell to 536 in 2025, which the foundation calls substantially fewer than the year before.
- PHP is receiving nearly twice as many proposed code changes as a year ago, but contributor numbers have not doubled.
- Two critical bugs, each rated CVSS 9.2, were patched on October 21, 2026 in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- If you run PHP in production, update first. Then think about whether your company should sponsor.
What does it mean that the PHP Foundation is under-funded?
It means the people who maintain the language are paid far less than the software they maintain is worth to everyone else. PHP may underpin up to 70% of websites, according to the Reuters report. The nonprofit behind its core development runs on donations, with one salaried employee and unpaid board members.
The easiest way to see it is a comparison. This one is mine, not Reuters'.
Imagine a bridge that carries 70 out of every 100 trucks in your region. Thousands of companies drive across it every day. The upkeep is paid for by voluntary tips left in a jar. One inspector works full time. A dozen more help part time. When a crack is found, that small crew has to find it, fix it, test it and warn every driver.
That is the shape of the problem. The bridge works fine most days. The risk is not that it falls tomorrow. The risk is that the crew has no slack when something serious shows up.
This week something serious showed up.
How is the PHP Foundation funded, step by step?
The PHP Foundation is funded by sponsors and individual donors who pay through Open Collective, a platform for open source funding. The money, minus fees, pays contracted developers to work on the language. Money flows in a fixed order, and each step leaks a little.
Here is the path, using the foundation's own 2025 Impact and Transparency Report, published May 27, 2026.
- Companies and individuals donate. Top 2025 sponsors included the Sovereign Tech Agency, JetBrains, Automattic, GoDaddy, Sentry and Craft CMS. In total, 536 sponsors and individuals gave in 2025.
- A fiscal host takes fees. The report says fees include a 10% Open Source Collective host fee and 1 to 5% payment processing fees, depending on payment method. In 2025 that came to $85,343.
- The foundation contracts developers. As of January 1, 2026 it had 11 contracted developers. The stated goal is competitive salaries for as many core developers as possible.
- Developers ship work. That covers language features, bug and security fixes, release management, the RFC process and tools such as PIE and Windows builds.
- A small team coordinates it all. The executive director, sponsored by JetBrains, is the one full-time role. Eight board members are volunteers.
The contractor count differs between sources. The report counts 11 developers at the start of 2026. Barron told Reuters the figure is 14 mostly part-time contractors in October. Both can be true, since the team may have grown or the 14 may include non-developer roles. The sources do not say which.
What do the PHP Foundation's finances actually show?
The foundation spent more than it received in each of the last two years. In 2025 it received $645,191 after fees and spent $784,376, according to its own report. That is a gap of about $139,000, which the report calls a deliberate choice to keep investing in technical headcount.
| Year | Total donated | Fees | Received | Expenses |
|---|---|---|---|---|
| 2021 to 2022 | $712,484 | $90,273 | $622,211 | $133,285 |
| 2023 | $478,767 | $60,098 | $418,669 | $275,181 |
| 2024 | $683,550 | $83,110 | $600,440 | $635,487 |
| 2025 | $730,534 | $85,343 | $645,191 | $784,376 |
Source: The PHP Foundation 2025 Impact and Transparency Report, May 27, 2026.
Three things stand out.
- Spending grew faster than income. Expenses rose from $275,181 in 2023 to $784,376 in 2025. Donations rose from $478,767 to $730,534.
- The report says reserves are healthy. It gives no exact cash balance, so do not trust any specific figure for how long the money lasts. One Hacker News commenter linked the public Open Collective ledger and said the balance was shrinking. You can check that ledger yourself at opencollective.com/phpfoundation.
- The foundation knows. Its 2026 goals include onboarding a Director of Fundraising and to "balance spending with funding." It calls fundraising "increasingly challenging" across open source.
Why did this come up now?
It came up now because PHP just had a security emergency. On October 21, 2026 the PHP project released fixes for two critical remote code execution bugs, CVE-2026-109618 and CVE-2026-109619, each rated CVSS v4.0 9.2 in the advance notice. Reuters then asked the foundation how it copes.
Here is what the advisory on php.net says.
| CVE | What it is |
|---|---|
| CVE-2026-109618 | Out-of-memory handling can interrupt PHP while request data is partly initialized, and cleanup may treat invalid data as valid |
| CVE-2026-109619 | Request-owned state can outlive its freed memory and be used by a later request on the same worker |
The advisory says all PHP installations serving web requests are affected, including PHP-FPM, Apache with mod_php, php-cgi, FrankenPHP and LiteSpeed. The risk is highest for mod_php, where an unauthenticated request can trigger the attack before any application code runs.
A third issue, CVE-2026-115560, got a separate advisory on October 23. It needs an unusual combination: an app that sets session.serialize_handler to php_binary or php_serialize in config, then switches to php with ini_set() before session_start(), with upload progress still enabled.
For a longer walk-through of the bugs themselves, read our PHP2Shell breakdown.
On the response side, Reuters reports the foundation worked with OpenAI, Wiz and Calif to investigate and coordinate fixes. It also reports that Cloudflare has seen millions of hacking attempts. Barron said the foundation had no evidence that attackers exploited the flaws before disclosure or on patched sites.
How is AI changing the workload for PHP maintainers?
AI is helping researchers find old bugs faster while also burying maintainers in more work. Barron told Reuters that AI helped find flaws that had existed for about a decade. She also said PHP is getting nearly twice as many proposed code changes as a year ago, while the number of contributors has not doubled.
That is the real squeeze. Review time is the scarce resource, and it does not scale with the number of pull requests.
A secondary report from BigGo adds that since July 1 the security team has published 15 CVEs and worked through more than 100 invalid, duplicate or non-reproducible reports. I could not confirm that figure on a primary source, so treat it as indicative only.
When should you act on this, and when can you relax?
Act on the patch immediately. Do not panic about PHP disappearing. The funding story is a long-term risk to maintenance speed. The CVEs are a today problem for anyone running a web-facing PHP server.
| Your situation | What to do |
|---|---|
| Running PHP 8.2 to 8.5 in production | Update to 8.2.35, 8.3.36, 8.4.27 or 8.5.12 now |
| Running PHP 7.4, 8.0 or 8.1 | No project updates. Use a vendor backport, the minimal source backports the security team published, or upgrade |
| Running PHP 8.2 | Plan the next move: it reaches end of life on December 31, 2026 |
| Cannot update today | Apply the partial mitigations below, but know they do not make you safe |
| Use PHP only through a host | Ask your host whether they have applied the patch |
| Your company earns money from PHP | Ask who owns sponsorship budget. The foundation lists a sponsor page |
The advisory is blunt: updating is the only complete fix.
If you do not need to worry yet about funding, you still should not ignore it. Fewer paid hours means slower reviews, and slower reviews mean slower fixes next time.
A small example: check your version and apply a stopgap
First, see which PHP version your server actually runs. The CLI can differ from the web SAPI, so check both.
php -v
# For the web SAPI, drop this in a temp file and request it once, then delete it
echo '<?php echo PHP_VERSION;' > /var/www/html/v.php
You are patched if the output is 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later on your branch. If your vendor backports fixes, the version string may look older, so ask them.
If you cannot update right away, the advisory lists this stopgap for CVE-2026-109619. Put it where it applies before request parsing, such as php.ini, the FPM pool or the server config:
; php.ini, FPM pool, or server config that applies before request parsing
session.upload_progress.enabled=0
Then restart every PHP worker. The advisory says not to rely on ini_set() or FPM .user.ini for this.
For CVE-2026-109618, the advisory suggests a low post_max_size (8M if you do not need uploads, 32M if you do), request limits at the web server or proxy, and a container or cgroup limit that kills only the affected worker. It warns against RLIMIT_AS and RLIMIT_DATA, since they can trigger the vulnerable allocation failure.
These are partial mitigations. Update when you can.
What did Hacker News say?
The Hacker News thread had 5 points and 6 comments when I read it. It split three ways. One commenter urged companies to sponsor the foundation at higher amounts. One pointed out that the single full-time employee is the director herself. Others made jokes about dependency risk and AI spending. None of the comments added verified facts, so I did not build on them.
FAQ
How many people work full time at the PHP Foundation?
One. Executive Director Elizabeth Barron told Reuters on October 23, 2026 that she is the only full-time staff member. The foundation also has about 14 mostly part-time contractors, and its board members are unpaid volunteers.
How much money does the PHP Foundation receive?
In 2025 it received $730,534 in donations and $645,191 after fees, according to its 2025 transparency report. It spent $784,376 that year. All transactions are public on its Open Collective page.
Is PHP going away?
Nothing in the sources says so. The foundation reports healthy reserves, and the project shipped PHP 8.5 in 2025 and security fixes in October 2026. The risk is slower maintenance and review if funding stays tight, not sudden shutdown.
Which PHP versions fix the October 2026 vulnerabilities?
PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.6.0 RC4 also includes the fixes but is for testing only. PHP 7.4, 8.0 and 8.1 have no official project updates, only minimal source backports from the security team.
What to do next
Patch first, then ask who in your company decides open source spending. Browse the free tools on Art of Code, and if you are weighing which language to bet your career on, read best programming languages 2026 to get hired or our post on the languages used to build programming languages.
Written by Adithya Guttha, Founder of Art of Code.
Sign in to like and save posts.
Keep reading
Discussion
Comments (0)
Want to join the conversation?
Sign in to commentNo comments yet. Be the first to comment!