Abstract:
The maintenance of the open source programming language PHP is facing severe resource pressure. Although PHP has been developed for about 30 years and supports the operation of a large number of websites around the world, the PHP Foundation, a non-profit organization responsible for supporting the development of this language, has been underfunded for a long time. Elizabeth Barron, executive director of the foundation, recently revealed that the organization currently has only one full-time employee, and the rest of its work is mainly maintained by part-time contractors, donations and grants.
Barron said in an interview with Reuters that the foundation currently has only one full-time staff member, and there are 14 other contractors who are mainly part-time. All members of the foundation's board of directors perform their duties as volunteers and do not receive remuneration. The organization's operating funds mainly come from corporate and individual donations, as well as various funding projects.
PHP is one of the most widely used programming languages in Internet infrastructure. According to relevant estimates, as many as 70% of the world's websites may use PHP to varying degrees. This language is widely used in website backends, content management systems, e-commerce platforms and various network services. Therefore, its security and stability are not only related to developers, but also affect enterprises, government agencies and ordinary Internet users.
Two recent serious security breaches have further highlighted the practical importance of PHP maintenance. This week, researchers discovered two critical vulnerabilities, prompting website operators across Europe to urgently check their systems and install security patches. Some government websites were temporarily offline so that operators could take protective measures until the risk was under control.
The PHP Foundation is working with external researchers and multiple companies, including OpenAI and cybersecurity companies Wiz and Calif, to investigate these vulnerabilities and coordinate fixes. The relevant patch was released this week. Cybersecurity company Cloudflare reported that related incidents triggered millions of hacking attempts. However, Barron said that the foundation currently has no evidence that attackers successfully exploited these flaws before they were publicly disclosed, and has not received further reports from relevant partners that systems that have been patched have been exploited.
It is worth noting that these vulnerabilities have existed for about ten years and were only recently discovered. Artificial intelligence technology plays a dual role in this process: on the one hand, it helps researchers identify potential security issues and improves programmers' work efficiency; on the other hand, AI tools also lower the threshold for submitting code modifications, resulting in maintenance teams needing to handle more code changes and error reports.
Barron said that the PHP project currently receives nearly twice as many code modification proposals as a year ago, but the number of contributors has not doubled simultaneously. This means maintainers must spend more time reviewing code, analyzing problem reports, and judging whether submitted changes will introduce new vulnerabilities or break existing functionality. Although AI can assist with programming, code review still requires significant human input and professional experience and cannot be accomplished solely by automated tools.
For open source projects, just because the code can be viewed by the public does not mean that its maintenance can be completed entirely by volunteers. Especially for basic software like PHP, which is used by a large number of commercial systems and public services, a seemingly small flaw may affect a large number of websites. The maintenance team not only needs to continuously improve the language itself, but also must deal with security holes, compatibility issues, bug reports, and changes submitted by developers.
The dilemma faced by the PHP Foundation also reflects a long-term problem in the open source software ecosystem: the scope of use of software does not always match the resources available to maintainers. Enterprises and government agencies can build and operate important business systems through PHP, but maintenance of the underlying language may rely on limited teams and unstable sources of donations and funding. Once safety issues occur intensively, limited manpower may be under tremendous work pressure.
Barron believes that considering the widespread use of PHP in corporate and government systems, the resources currently received by the foundation are obviously insufficient. As AI tools continue to drive the number of code submissions, how to expand funding sources, add professional maintenance personnel, and ensure that security issues can be handled in a timely manner will become important issues that the PHP ecosystem needs to face.
This incident also reminded the industry once again that open source software is not without costs. Users can obtain and use the software for free, but long-term security maintenance, bug fixes and version updates of the software still require continued investment of funds and professional manpower. For the basic programming languages that support a large number of Internet services, establishing a maintenance mechanism that matches their actual influence is not only an issue within the developer community, but also related to the security and reliability of the entire Internet infrastructure.
Related articles:
PHP fatal vulnerabilities are rampant, 70% of the world’s websites are threatened, and many companies have been “offlined” overnight
PHP vulnerability crisis enters second day: hacker attacks surge to one million times Government services in many countries are still disrupted
PHP Foundation discloses new vulnerabilities that have not yet been fixed and provides mitigation solutions but will not release new versions to fix them for the time being
Comments