[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-php-powers-71-of-sites-with-one-full-time-employee":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},12392,"php-powers-71-of-sites-with-one-full-time-employee","PHP Powers 71% of Sites With One Full-Time Employee","A critical PHP bug exposed a thin foundation, but the bigger problem is that nearly 73% of installs run versions past end-of-life.","A critical PHP vulnerability has exposed two separate problems at once: the nonprofit that maintains the language is tiny, and most of the web is not running a version that still gets fixes.\n\nThe flaw, called PHP2Shell, is a remote code execution bug, meaning an attacker could run commands on someone else's server. PHP runs roughly 71% of websites. In an interview, PHP Foundation Executive Director Elizabeth Barron said she is the only full-time staffer, backed by 14 contractors described as \"mostly part-time\". Barron said there was no reported exploitation before the fix shipped.\n\nThe timeline is the uncomfortable part. The underlying out-of-memory condition was first found in 2024, and work on it \"stalled and restarted repeatedly over months\", partly because so many third-party extensions depend on the affected code. Then security firm Chainguard accidentally broke the embargo, the agreed delay before details go public. Barron credited Foundation funding with letting several people work on the fix around the clock, including weekends.\n\nThe patch was only one point release away, and anyone on a current 8.x version could apply it in minutes. Many did not. Nearly 73% of PHP installations run versions past their end-of-life date, when official fixes stop. Many of those servers are on PHP 7, released in late 2015, and about 7.7% of PHP sites still run 5.x, which first appeared in 2005 and was retired in 2018. Some sites went offline for hours or days rather than risk exploitation.\n\nThe two failures feed each other, but they have different cures. More money could shorten the gap between discovery and fix. It cannot upgrade a server whose owner stopped paying attention years ago. The Linux kernel, which takes contributions in a similar way, has many full-time and company-employed developers, and PHP has far fewer. Even a fully staffed PHP team would still leave most of the web waiting on administrators to install what it ships.","[\"php\",\"open-source\",\"vulnerability\",\"funding\"]","2026-10-26T11:50:00.000Z","2026-11-07T23:56:58.060Z","2026-11-07T23:56:58.242Z","published",null,[],"security",[26,27,28,29],"php","open-source","vulnerability","funding",[31],{"name":32,"url":33},"Tom's Hardware","https:\u002F\u002Fwww.tomshardware.com\u002Ftech-industry\u002Fcyber-security\u002Flack-of-funding-likely-led-to-the-recent-php-security-snafu-but-thats-just-the-tip-of-the-iceberg-a-dreary-situation-caused-by-services-running-old-versions-with-no-support",0,{"sections":36},[37,42,46,51,56,61,66,71,76,81,86,91,96,101],{"name":38,"slug":39,"count":40,"latest_published_at":41},"AI","ai",7110,"2026-11-08T14:34:09.000Z",{"name":43,"slug":24,"count":44,"latest_published_at":45},"Security",1099,"2026-11-08T15:24:01.000Z",{"name":47,"slug":48,"count":49,"latest_published_at":50},"Deals","deals",620,"2026-11-08T08:00:00.000Z",{"name":52,"slug":53,"count":54,"latest_published_at":55},"Policy","policy",604,"2026-11-07T15:48:26.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Consumer Tech","consumer-tech",336,"2026-11-08T21:00:00.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Hardware","hardware",316,"2026-11-08T14:36:39.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Science","science",222,"2026-11-07T16:19:17.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Software","software",154,"2026-11-08T15:42:52.000Z",{"name":77,"slug":78,"count":79,"latest_published_at":80},"Startups","startups",150,"2026-11-06T16:50:01.000Z",{"name":82,"slug":83,"count":84,"latest_published_at":85},"Dev Tools","dev-tools",125,"2026-11-06T22:15:59.000Z",{"name":87,"slug":88,"count":89,"latest_published_at":90},"General","general",111,"2026-11-08T21:27:29.000Z",{"name":92,"slug":93,"count":94,"latest_published_at":95},"Gaming","gaming",94,"2026-11-08T20:52:05.000Z",{"name":97,"slug":98,"count":99,"latest_published_at":100},"Reviews","reviews",38,"2026-10-20T12:00:00.000Z",{"name":102,"slug":103,"count":104,"latest_published_at":105},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]