Thirteen is two more than a cricket team. That is how many engineers the PHP Foundation currently pays, full-time or part-time, to maintain and develop PHP, a programming language that sits behind a huge share of the web. The number comes from the Foundation’s own website, and it is worth pausing on.
PHP works quietly in the background of a website. When you open a page, PHP often helps the site fetch information, handle your request and put the page together. It is more than 30 years old, and WordPress and Drupal, two of the most popular tools for building websites, run on it. According to W3Techs, which tracks web technology, PHP is used by about 70.5 per cent of the websites whose server-side language is known. That is a large part of the internet, including government services, online shops, banks and media sites.
The PHP Foundation is not an old institution. It was launched on 22 November 2021 with one main job: to fund developers to work on PHP, full-time or part-time. One of the sparks was the news that Nikita Popov, one of PHP’s most prolific contributors, would spend far less time on the language after leaving JetBrains. The Foundation lives on contributions from companies and individuals. In 2023, it received $418,669. Its report for 2024 counted ten paid developers. Today its website lists 13.
Those 13 are not the only people who matter. PHP is an open source project, and volunteers still help. The Foundation’s own words are that security work on PHP depends on “a small group of foundation-funded developers and a little volunteer help.” But the paid engineers are the ones who can work on the hardest problems for weeks at a time, and this October showed why that matters.
On 21 October 2026, the PHP project released versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35. They fixed two critical flaws, CVE-2026-109618 and CVE-2026-109619, each scoring 9.2 out of 10 for severity. Under the right conditions, an attacker with no password could run their own code on a server. Both flaws sit in parts of PHP that nearly every request touches, which is exactly why they were so hard to fix. For the first flaw, every possible fix had a cost: it could break older websites, create new ways to crash a server, or force changes in extensions built by other developers.
The first signs of that problem were spotted in 2024, during PHP’s first outside security audit in years, which the Sovereign Tech Agency helped fund. But nobody could show how an attacker would use it, and the work on a fix stalled for months. The Foundation has since called the delay a “structural failure”. It blamed how the security team makes decisions and its lack of resources, and it noted that the few developers with deep knowledge of PHP’s engine were busy with many other duties. Things changed on 11 August 2026, when researcher Ryan A of the security firm Calif reported a remote code execution flaw with the same root cause. From then on, fixing it became the top priority. The Foundation says that without its funding, it would have been impossible to have several people work on the issue full time, through weekends and around the clock.
The workload is also growing. Tools, including AI, now find bugs faster than ever. By mid-October, the PHP security team had published 15 CVEs since 1 July and had gone through more than 100 reports that turned out to be invalid, duplicates or impossible to reproduce. The Foundation says AI helps it check and group reports, but a person makes every call and works on every patch. What tools cannot do, it says, is choose the right fix for a long-standing design decision, weigh the trade-offs and review the patch. That takes engineers who know the whole PHP codebase, and the Foundation admits there are too few of them.
The Foundation is trying to change that. It created an Ecosystem Security Team in May 2026. Alexandre Daubois joined in July to help handle security reports, and Daniel Scherzer joined in September to work on hardening PHP. Now it is asking for more help. It wants sponsorship from companies that build on PHP, from hosting providers, cloud platforms and Linux distributions that deliver it to users, and from governments whose services run on it.
If you run a website, the advice is simple: update to a fixed PHP version, or ask your hosting provider whether they have. PHP 8.1 and older no longer get updates from the PHP project. If you only visit websites, there is nothing to do. But the next time a page loads without a problem, remember that a small team of 13 paid engineers, helped by a few volunteers, plays a big part in keeping that possible.
Subscribe Deshwale on YouTube
