PHP’s latest crisis exposes who pays for the internet’s foundations

A familiar failure pattern

PHP runs behind many websites. Its name stands for PHP: Hypertext Preprocessor, but the more important point is how much infrastructure relies on it. The author says readers have almost certainly used PHP-powered sites this week.

This is not the first time a critical internet component has depended on a handful of people with too little support. In 2014, the author wrote about Heartbleed, a flaw in OpenSSL, which helps secure internet communications. At the time, two developers named Steve were doing much of the work on OpenSSL with almost no funding.

Other episodes followed:

In each case, small teams working on software used for the common good spotted the danger and helped avert disaster. The pattern is familiar: essential infrastructure, limited resources, and a few specialists carrying disproportionate responsibility.

AI is speeding up both sides

The PHP Foundation said this week that its developers found a potentially internet-disrupting problem in 2024, but judged the fix too costly and difficult. The foundation later called the delay a “structural failure” tied to a lack of resources.

In August, researchers from Calif, OpenAI and Wiz demonstrated how easily AI tools could be used to attack the PHP vulnerability. Hackers soon followed. Cloudflare CEO Matthew Prince said the company had recorded millions of attempts to exploit it.

The wider volume of reported vulnerabilities is rising too. Researchers documented about 48,000 in 2025. In 2026, the count has already passed 84,000, with more than two months left in the year — roughly one new vulnerability every five minutes. The PHP flaw scored 9.2 out of 10 for severity, but not every vulnerability in that growing stream is as serious.

Automated AI systems can scan for weaknesses quickly, then flood specialists with reports that still need human review. That makes finding vulnerabilities cheaper; it does not make fixing them easy, especially in old systems.

A 2025 UK government review found that about 28% of technology used by central government bodies was legacy. Some organizations could not even estimate how much old software they relied on. In April, ministers acknowledged they could not produce a complete account of what had since been fixed or retired.

Who pays for the foundations?

Organizations need an inventory of the software they use, including the hidden components their systems depend on, and a clear record of who is responsible for fixing each one. It is routine documentation, which is exactly why it is often deferred. AI may help, but the people responsible for protecting users still need adequate funding.

There are signs of progress. Last year, the OpenSSL Foundation received more than 400,000 euros from Germany’s Sovereign Tech fund to strengthen its resources. The PHP Foundation has hired additional staff and is using AI to sort issues by priority. Several organizations installed patches before the PHP vulnerability became public.

My concern is that these are isolated improvements, not a durable funding model. Large technology companies earn billions from software they get for free through open source. Governments also rely on that software. Both should contribute to its upkeep rather than assume a handful of exhausted developers can keep critical systems running indefinitely.

The author has written about Heartbleed, Log4Shell and XZ Utils, and now the consequences of the PHP vulnerability. I think the recurring story is not a shortage of warnings; it is that the people maintaining shared infrastructure are still expected to do more with too little. If that does not change, faster vulnerability discovery will keep widening the gap between finding a weakness and having the resources to close it.