The PHP Foundation, the nonprofit that funds development of the programming language behind much of the web, operates on an annual budget of roughly $974,000 and a payroll of one full-time employee, Executive Director Elizabeth Barron said Friday, as two critical security flaws set off a worldwide patching effort this week.

A single full-timer and 14 contractors

“We have one full-time staff member (that’s me) and 14 mostly part-time contractors,” Barron said in an interview. The foundation’s board is unpaid, and its money comes from grants and donations.

The foundation’s Open Collective page lists its yearly budget as $974,057.80. Since its launch in late 2021, the organization has raised $3.06 million and spent $2.70 million, leaving $356,614.52 — enough to cover about four months of expenses. The page shows that 1,927 people have donated and that 340 people hold monthly pledges worth roughly $9,416 in total. If sustained for a full year, that recurring stream would amount to about $113,000 — roughly 12 percent of the budget — with the rest of the foundation’s funding arriving through larger grants and donations.

Barron said proposed changes to PHP code have almost doubled in a year, and contributors have not kept up. Every submission and bug report still has to be reviewed by experienced people.

Artificial intelligence cuts both ways, she noted. AI helped researchers detect the two flaws, which had sat in the PHP code for a decade, and it makes programmers faster — but it also adds review burden for maintainers. She described the language as badly underfunded given how much companies and governments rely on PHP.

Backers and spending

Automattic has been the foundation’s biggest backer since December 2021 at $762,500, followed by JetBrains at $476,670. The Sovereign Tech Fund has provided about $214,115 and the Linux Foundation $183,500. Smaller amounts come from Private Packagist, Craft CMS, Cybozu and Tideways, while Zend by Perforce has given $56,000 and GoDaddy $48,000. The Chainguard Team has contributed $50,000 since October 21, the day PHP released its patches. Together, the four largest backers account for more than $1.6 million — over half of the $3.06 million raised to date.

The foundation states on its page that it pays developers to work on the PHP language. Core developer work is its largest tagged expense category, accounting for 227 payments totaling about $1.11 million out of 526 paid expenses.

PHP2Shell flaws drew millions of exploit attempts

PHP issued patches for CVE-2026-109618 and CVE-2026-109619 on October 21, both with a severity rating of 9.2 out of 10, Cryptopolitan reported. The pair, dubbed PHP2Shell, could allow attackers to execute code without logging in. Wiz showed that the flaws can also spill passwords and API keys from memory. The fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 — the four releases site operators can check their deployments against.

Cloudflare registered millions of exploit attempts, and government websites in Finland, the Netherlands and France went offline temporarily. The foundation is working with OpenAI, Wiz and Calif to fix the issues.

Barron said there was no evidence hackers exploited the flaws before their disclosure or on patched sites.

PHP, an open-source language more than 30 years old, is employed on 69.3% of websites where the server-side language is known, according to W3Techs.