PHP Foundation 'Under-funded' With One Full-time Staff Member, Director Says (reuters.com) 39
Cloudflare reported millions of attempts to exploit two serious PHP flaws this week. The PHP foundation has "no evidence hackers were able to exploit the vulnerabilities before they were disclosed," reports Reuters, but the incident still shows how critical the three-decade-old programming language is.
"Yet the nonprofit foundation that supports PHP, which may underpin up to 70% of sites globally, operates on a shoestring budget." "We have one full-time staff member (that's me) and 14 mostly part-time contractors," Executive Director Elizabeth Barron of the PHP Foundation said via email in an interview on Friday. Board members are unpaid volunteers, and funding comes from donations and grants. The foundation works with outside researchers and companies, including OpenAI and cybersecurity firms Wiz and Calif, to investigate security flaws and coordinate fixes, including Wednesday's patches... "We received no further indication from OpenAI, Wiz or Calif, with whom we're working closely on this issue, regarding any issues on patched systems," she said...
Recent events have shown how heavily companies and governments rely on PHP, Barron said. "Given that reliance, it is clear that PHP is incredibly under-funded."
AI helps researchers find decade-old flaws, but "it is also increasing maintainers' workloads," the article points out. "The PHP project is receiving nearly twice as many proposed code changes as a year ago." But unfortunately, the foundation's executive director says "the number of contributors hasn't doubled," and reviewing contributions and bug reports requires "a massive amount of human input and experience."
Wednesday the foundation said they hope to increase the number of knowledgeable engineers, but also "give the security team the resources it needs. We can only achieve this goal with funding from those who depend on PHP."
Their blog post also acknowledged the first signs of the bug were discovered in 2024, but that work on a fix stalled and restarted repeatedly over months (when there was still no known path to remote code execution): We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources. The security team has since started changing its processes, and that work continues, so that decisions can be made by majority and compromises are encouraged...
The coordinated disclosure of these vulnerabilities worked well until 2 days ahead of the targeted release date. On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media... In response, the PHP project brought its pre-announcement forward [and also the release date for the patch. But as a result of the leak and pre-announcement] one of the security firms that had reported the issues mistakenly published a video. It showed their proof of concept working against a number of targets and revealed a few additional, though limited, details about the vulnerabilities. Copies of the deleted video started circulating on social media soon after. The video contributed to accelerated development of various exploitation proofs of concept, which then increased circulation on October 21st. Mitigation advice we started providing to a few critical infrastructure providers around Oct 20th 23:00 UTC, may have leaked as well. The PHP security team closely monitored and inspected appearing proofs of concept after the leak but did not identify any functional exploits at the time of release/public disclosure.
On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.
But the PHP Foundation also said Wednesday's patch "shows the progress we're making in how PHP security is handled." Once the full impact of the OOM problem was understood in August, the security team, the foundation, and the release managers delivered a fix for this deeply rooted problem across all supported branches, and distributions and LTS vendors received the patch ahead of time so their users can update quickly... We are now prioritizing measures to make sure vulnerabilities that need similarly complex fixes get resolved faster when they are reported in the future.
Thanks to Slashdot reader Mirnotoriety for sharing the news.
"Yet the nonprofit foundation that supports PHP, which may underpin up to 70% of sites globally, operates on a shoestring budget." "We have one full-time staff member (that's me) and 14 mostly part-time contractors," Executive Director Elizabeth Barron of the PHP Foundation said via email in an interview on Friday. Board members are unpaid volunteers, and funding comes from donations and grants. The foundation works with outside researchers and companies, including OpenAI and cybersecurity firms Wiz and Calif, to investigate security flaws and coordinate fixes, including Wednesday's patches... "We received no further indication from OpenAI, Wiz or Calif, with whom we're working closely on this issue, regarding any issues on patched systems," she said...
Recent events have shown how heavily companies and governments rely on PHP, Barron said. "Given that reliance, it is clear that PHP is incredibly under-funded."
AI helps researchers find decade-old flaws, but "it is also increasing maintainers' workloads," the article points out. "The PHP project is receiving nearly twice as many proposed code changes as a year ago." But unfortunately, the foundation's executive director says "the number of contributors hasn't doubled," and reviewing contributions and bug reports requires "a massive amount of human input and experience."
Wednesday the foundation said they hope to increase the number of knowledgeable engineers, but also "give the security team the resources it needs. We can only achieve this goal with funding from those who depend on PHP."
Their blog post also acknowledged the first signs of the bug were discovered in 2024, but that work on a fix stalled and restarted repeatedly over months (when there was still no known path to remote code execution): We won't pretend otherwise: the delay was a structural failure, caused by both the security team's decision process and its lack of resources. The security team has since started changing its processes, and that work continues, so that decisions can be made by majority and compromises are encouraged...
The coordinated disclosure of these vulnerabilities worked well until 2 days ahead of the targeted release date. On Tuesday, October 20th, at around 15:00 UTC, the two CVE IDs began circulating on online forums and social media... In response, the PHP project brought its pre-announcement forward [and also the release date for the patch. But as a result of the leak and pre-announcement] one of the security firms that had reported the issues mistakenly published a video. It showed their proof of concept working against a number of targets and revealed a few additional, though limited, details about the vulnerabilities. Copies of the deleted video started circulating on social media soon after. The video contributed to accelerated development of various exploitation proofs of concept, which then increased circulation on October 21st. Mitigation advice we started providing to a few critical infrastructure providers around Oct 20th 23:00 UTC, may have leaked as well. The PHP security team closely monitored and inspected appearing proofs of concept after the leak but did not identify any functional exploits at the time of release/public disclosure.
On October 21st at 07:41 UTC, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published built images containing the fix. Like other distributors, Chainguard had received the patch in advance so its users could update the moment the vulnerabilities were disclosed. Any attacker could now study the fix in binary form while every other PHP user was still waiting for the release. This disregarded weeks of work by many parties toward a coordinated disclosure.
But the PHP Foundation also said Wednesday's patch "shows the progress we're making in how PHP security is handled." Once the full impact of the OOM problem was understood in August, the security team, the foundation, and the release managers delivered a fix for this deeply rooted problem across all supported branches, and distributions and LTS vendors received the patch ahead of time so their users can update quickly... We are now prioritizing measures to make sure vulnerabilities that need similarly complex fixes get resolved faster when they are reported in the future.
Thanks to Slashdot reader Mirnotoriety for sharing the news.
Obligatory xkcd (Score:5, Insightful)
xkcd 2347: Dependency [xkcd.com]
You get what you paid for (Score:5, Interesting)
I mean if you abdicate your responsibility and assume someone else will pick up the slack then it's your responsibility to own the technical debt because you assumed "everything is good" but feel it's not financially responsible to contribute.
"You get what you paid for."
Re: (Score:2)
Re: You get what you paid for (Score:1)
Re: (Score:3)
Nope. The Open Source ethos is that you get to use the software (you need explicit permission), and also to see the source code and modify it if you want, provided you contribute back. You can contribute with money, or with resources, or with bug reports, or even with explicit attribution, etc.
What you are seeing here is several generations of startups and small or large businesses using software they found on the internet for free, setting up a website once and never maintaining it. The fact that the sof
Re: (Score:2)
What you are seeing here is several generations of startups and small or large businesses using software they found on the internet for free, setting up a website once and never maintaining it.
I would argue this point. This was a bug in the current public releases of PHP. It hit web sites that were diligently maintained, not just those that were set up once and never maintained.
And, really, while you may not like that most of them don't give back to PHP or Apache or whoever... if that were meant to be a requirement, it could've been built into the various open-source licenses from the get-go.
Re: (Score:2)
If it hasn't actually been exploited then it hasn't "hit" anybody.
Re: (Score:2)
It is a problem of the user, as we've seen demonstrated again and again.
You use a software called "personal home page" for your entrepreneurial infrastructure?
Sorry.
I'd say open source has this well known flaw (Score:1)
But then I've had to deal with shitty paid-for commercial software too. Both bespoke custom jobs and mass market consumer-ish stuff pressed into service as the same.
Just scrap the whole thing and rewrite in assembly. Make sure to comment well.
Gemini can you translate troll to neurotypical? (Score:2)
Disclosure: I fed my initial "old man yells at cloud" reaction into an AI and asked it to separate the arguments from the emotions. The result is below. Feel free to blame either of us.
Every open-source governance problem is increasingly being described as a funding problem. Sometimes it is. But before concluding PHP needs more money, I'd like to know why a language used by so much of the Internet can't attract enough contributors under its current structure. Funding may be the symptom rather than the cause
Pay attention to what people say (Score:2)
"no evidence hackers were able to exploit the vulnerabilities before they were disclosed,"
This is NOT as meaningful as the people saying it want to trick you into believing it is.
Be careful (Score:2)
Time to move on (Score:5, Interesting)
Use tax money (Score:2)
At least here in America if these hugely important open source projects are in need of support we should have some grant money for them to keep these hugely economically important things moving, particularly if the foundation/engineers are based in the US as that makes it much easier but I would encourage other regions to do the same if they don't already. Some things are too important to leave to charity alone.
The cost of these things breaking can far outweigh what the cost to keep them maintained would.
Re: (Score:3)
A sure fire way to introduce politics into development and support efforts. And have them flip-flop at every change in the administration. DEI, anti-DEI, DEI, ...
We could impute income for any profit making venture that "receives" free stuff without providing remuneration. Want an offsetting credit for that? Contribute to the applicable 501(c)3.
Re: (Score:2)
It's exhausting keeping an eye on their ever-growing CoCs.
Re: (Score:2)
. And have them flip-flop at every change in the administration.
United States Congress [wikipedia.org]
I know Republican's have forgotten such a thing exists but it does exist and you can write the law so none of that happens.
I don't get it (Score:5, Insightful)
... the nonprofit foundation that supports PHP, which may underpin up to 70% of sites globally, operates on a shoestring budget.
Followed by:
"We have one full-time staff member (that's me) and 14 mostly part-time contractors," Executive Director Elizabeth Barron of the PHP Foundation said via email in an interview on Friday. Board members are unpaid volunteers, and funding comes from donations and grants.
So let's postulate a better budget. I'm just guessing, but let's say that $150K yearly per programmer, and $200k per year for the lead guy, would keep them happy and productive. Then, throw in a few junior programmers to do scut work, and a couple of admins to hold it together - add $500K per year to the budget. By my math that's $2.8 million. Round up to $3 million, just because.
Even that somewhat inflated sum is pocket change for just one of the many major corporations which rely on PHP. Hell, it's a rounding error on the annual budgets of the biggest users. So if a half-dozen or so chipped in, they could do it with money pulled out of the couch cushions in the C-suite. And they'd get better maintenance, faster. Plus, they'd spend less money putting out fires, because the extra support would catch more problems before roll-outs. Their reputations would be better, and advertising their "largesse" would be a PR goldmine. So why aren't they ponying up?
IANAP, so I could be missing something here - please tell me if that's the case. But I've worked in tech all my life, I've done a little bit of coding, and I've seen my share of corporate stupidity up close. So I'm guessing that I'm not too far off the mark. And I'm still scratching my head.
Re: (Score:2)
I can't say for PHP itself, but I've been worried about PHP security for years. A BBS I installed using PHP wanted it installed as root. Total f*ck no. I've seen other apps running with elevated priveledges when they weren't needed. So many red flags I didn't use PHP because of the language itself, but because people that used it had zero worries about security.
Re: I don't get it (Score:1)
That's got zero to to with php and everything to do with the BBS application.
Re: I don't get it (Score:2)
Just a guess but maybe root was required to open port 80?
Re: (Score:3)
Unlikely, you don't implement HTTP in PHP, you normally use nginx/php-fpm and Apache/mod-php to run your PHP scripts.
Re:I don't get it (Score:5, Insightful)
Even that somewhat inflated sum is pocket change for just one of the many major corporations which rely on PHP.
I challenge you (well obviously this is impossible but you get the rhetorical point) to find one corporation in the entire world valued at over a billion that doesn't, say, use openssh. The OpenBSD foundation struggles to raise CAD 400,000 a year.
Sure they are legally allowed to be freeloaders. The point of the license is anyone can use it. It's really stupid however to contribute absolutely nothing when it's critical infrastructure you rely on day to day and you could easily afford a sponsorship. But it's the tragedy of the commons.
Re: I don't get it (Score:2)
It is the tragedy of the commons as you say. If I was Meta, for example, I would sue as heck adopt or contribute more heavily to the likes of php. But even Trillion dollar companies like Meta essentially freeload off the likes of Php where a contribution in the low millions or tens of millions works help bend development to their liking, curry favour with the open source community and be a genuinely good thing. But I guess companies are now meeting their doing good quota via some virtue signalling rather th
Re: (Score:2)
But even Trillion dollar companies like Meta essentially freeload off the likes of Php where a contribution in the low millions or tens of millions works help bend development to their liking,
Even less: clearly most of these companies don't particularly want to influence the directions (they could hire the devs if they really wanted to). They're jut content to use them. If they chucked, say, 10 grand a year at a handful of projects, the problem would be solved.
But I guess companies are now meeting their doi
Re: (Score:2)
The problem is that every company is looking at every other company to go first. They likely have the mindset "company X has a larger budget or company Y has a larger dependency on PHP, so they should be the ones to contribute".
Re: (Score:2)
Even that somewhat inflated sum is pocket change for just one of the many major corporations which rely on PHP. Hell, it's a rounding error on the annual budgets of the biggest users. So if a half-dozen or so chipped in, they could do it with money pulled out of the couch cushions in the C-suite.
I'm working at some /major/ corporation (it's also in dire financial straits and tries to save wherever it can - including on my employment arrangement). We don't use PHP (that I'm aware of) but we do use a (pretty large) number of other FOSS libraries, frameworks and technologies.
The divide between who decides to use some FOSS component (usually the project teams themselves, all running on a tight budget), and the people with the authority to write a 100 USD check (who usually don't have the faintest about software development or FOSS in particular) to the benefit of some FOSS outfit is so huge, I can't even imagine it will ever be bridged.
Thanks for the insight - that rings true to me and sounds like a major piece of the puzzle. It has me wondering if maintainers of the open-source software critical to so many companies could find a way to be more public about what they do. If more people in high places understood how important the maintainers' work is - and how little money it would take to keep the software they provide solid and secure - maybe the projects would be better funded.
"Poor me, I'm under-funded" (Score:1, Flamebait)
Let's keep in mind who Elizabeth Barron is: she's the prior Community Manager at GitHub who was best known for DEI initiatives. Before that, she was a Community Manager at Pivotal. Before that, she was the PHP Community Organizer at Engine Yard. Geeknet (of SourceForge and prior Slashdot relation)? You'll never guess! (OK, yes, it's, Community Organizer, er, no, "Development Manager".)
Her only personal github anything is an "about me" blog. She has no repos of "scripts I find useful" or "little cool thing I
Re: (Score:2)
bunny.net
[Sigh] Not the sort of bunnies I had in mind.
Re: (Score:2)
I too expected rabbits
Re: (Score:2)
Re: (Score:2)
Maybe I missed something but I can't find any whining
either they are lying or stupid (Score:2)
This work can be done by one or two developers through using a harness (claude code, hermes, opencode, etc) paired with a decent model. I can do the work of 20 people, and with the right orchestration, I can have 20+ agents doing the work of 400 people when I need to.
PHP Foundation Code of Conduct (Score:1)
Re: (Score:2)
You mean if they'd spent time harassing trans people rather than writing code they'd have caught bugs earlier?
Because the CoC isn't spending time on irrelevant stuff, it's about preventing spending time on irrelevant stuff. Like bringing up whatever you can to try to get talented programmers to leave.
Re: (Score:2)
BS!