PHP foundation 'under-funded' with one full-time staff member, director says

Board members are unpaid volunteers, and funding ​comes from donations and grants. Read:Millions of hacking attempts as companies, governments rush to patch PHP flaws. The foundation works with outside researchers and companies, including OpenAI ​and cybersecurity firms Wiz and Calif, to investigate security flaws and coordinate fixes, including Wednesday's patches.

While Web security company Cloudflare has reported millions of hacking attempts, Barron said the foundation had no ​evidence hackers were able to exploit the vulnerabilities before they were disclosed, or ​on sites that have been patched.

"We received no further indication from OpenAI, Wiz or Calif, with ‌whom ⁠we're working closely on this issue, regarding any issues on patched systems,” she said. Artificial intelligence has proved both a help and a burden to the foundation.

It helped researchers find the flaws, which had been present for a decade, and Barron ​said it made programmers ​more efficient. However, it ⁠is also increasing maintainers' workloads. The PHP project is receiving nearly twice as many proposed code changes as a year ago, “yet ​the number of contributors hasn't doubled,” she said.

Reviewing contributions ​and bug ⁠reports requires “a massive amount of human input and experience.”Read More:Government websites in Europe, elsewhere go dark as software flaw sparks security scramble. Recent events have shown how heavily companies and governments rely on PHP, Barron said.

“Given that reliance, it is clear that PHP ⁠is incredibly underfunded.”