PHP Foundation's lone full-timer faces twice the code proposals on $974K a year

PHP Foundation Executive Director Elizabeth Barron said Friday that proposed PHP code changes have nearly doubled in a year and contributors have fallen behind, while the foundation operates on an annual budget of $974,057.80 with Barron as its only full-time employee. The foundation pays developers to work on the language and relies on grants and donations. On October 21, PHP released fixes for two critical flaws, CVE-2026-109618 and CVE-2026-109619, both rated 9.2 out of 10 and called PHP2Shell, which could let attackers execute code without logging in. Barron said no evidence showed hackers exploited the flaws before disclosure or on patched sites.