This week we saw (again) that the Internet is hanging by a thread: two serious bugs in PHP have started a race against time to save a website that largely depends on that veteran open source language. PHP runs on about 70% of websites, according to W3Techs, so with this scope one would expect a similar level of organization behind it, but no: its operation is highly uncertain.
Elizabeth Barron is its chief executive and told Reuters she has just one full-time employee (herself) and 14 contractors, most of them part-time. The board is volunteer and funding comes from grants and donations. Come on, you can be real in the stock photo depicting the cover of the article.
A crisis with the unknown is chronological. The problem is far-fetched: the foundation identified a vulnerability during a security review in 2024, but then they didn’t find a known exploit and it was difficult to fix. In 2026, the vulnerability was discovered externally: cybersecurity firm Calif notified the team on August 11, OpenAI got there on its own, and Wiz notified the foundation on the 24th after five days of investigation. On October 20, as reported by Simon Willinson, two bug detectors were leaked, bringing the project forward to release by one day.
After a day the patch arrived. Later, Cloudflare recorded millions of attack attempts, as its CEO told Reuters. However, according to Elizabeth Barron, the foundation has no evidence that anyone took advantage of the vulnerabilities before they were made public or on websites that had already been patched. However, Amazon claims that its decoy systems detected an attack attempt from an anonymous IP on October 17. Who was and how he knew of the failure is unknown. However, it was not a real website but a scam.
Why is it important?. Taking into account that the bugs are in PHP and not in plugins, updating the content is not enough: PHP needs to be updated on each server and has complications, because compatibility with applications and extensions must be preserved.
However, this is not a structural problem that affects only the Internet (note, about 70% of websites where the server language is known), but also all kinds of companies and organizations. Barron is clear: Due to its reliance on companies and governments, PHP is “incredibly underfunded”.
Introduction to AI. As the foundation’s executive director explains, artificial intelligence offers a solution. Yes, it helps the research team find those bugs, which have been present for a decade and increases the efficiency of programming tasks, something that is necessary when hands are scarce.
But it also increases the workload of the people who maintain everything, since the task of reviewing possible changes falls to a few experienced people. The PHP project is accepting nearly twice the number of code change proposals than a year ago but “the number of contributors hasn’t doubled,” he admits.
In Xataka | What happened with PHP warns us: We have a serious problem with the old software that powers the Internet
In Xataka | How often we should change all our passwords, according to three cybersecurity experts
cover Cristina died
