Who Keeps the Web Running?
Published on 28 October 2026
On October 21, 2026, PHP urgently released fixes for two critical vulnerabilities that allow remote code execution on servers, without authentication. The language, which powers around 70% of websites with a known server-side technology, held firm. But the episode serves as an uncomfortable reminder: a massive part of the global Web rests on the shoulders of a few dozen developers. Open Source software still advances largely thanks to the volunteer work of its contributors. PHP operates like original free software: it is built collectively, without an owner. This model will only hold if it is funded.
PHP: A Living Language, but Without an Owner
PHP follows the original model of free and Open Source software: the language evolves thanks to the people who contribute to it. No tech giant pilots it, and no one imposes a top-down roadmap. Evolutions are discussed and voted on publicly. Thousands of companies depend on it. Online stores, banks, media, public services: according to the PHP Foundation, PHP powers a large portion of the Web we use every day.
A Critical and Fragile Dependency
PHP is used by 70.3% of websites with an identifiable server language (W3Techs, August 2026), including billionaire multinationals. Yet, according to the PHP Foundation, the security of the language still relies on a small group of developers funded by the foundation, complemented by a little volunteer help.
The October vulnerabilities show this clearly. The first sign of the issue was identified as early as 2024 by a core PHP developer, on the sidelines of a funded audit by Germany’s Sovereign Tech Agency. Lacking bandwidth and time, the fix stalled for months; the foundation itself speaks of a structural fragility. It took several research teams demonstrating remote code execution this summer to mobilize people full-time, weekends included.
This chain does not stop at the language. Around PHP revolve frameworks, libraries, and application servers, also maintained by small teams. This is the case with FrankenPHP, the application server created internally by us and officially supported by the PHP Foundation since June 2025. We know from the inside what it means to maintain a building block that others depend on.
Where Are the Big Players?
Large companies are not engaging enough. If they contributed proportionally to the resources they draw, the sustainability of the Web would not rest on a handful of people.
Tools, including AI, now spot bugs faster than ever: the PHP security team has published 15 CVEs since July. But no tool decides on the right fix or weighs compatibility trade-offs. That requires engineers who understand the core of the language, and there are far too few of them. The PHP Foundation is therefore directly asking companies, hosters, cloud providers, and public institutions relying on PHP to fund according to their dependency.
Our Commitment
Any organization can support Open Source, regardless of its size. At Les-Tilleuls.coop / Tilia, a worker co-op of over 80 people, we sponsor the PHP Foundation and maintain open-source projects like API Platform and FrankenPHP. Concretely, this means dedicated development time and financial contributions to PHP, FrankenPHP, and Caddy.
It is in our best interest: our business relies on these commons, just like our clients’ businesses do. Reinvesting in what we depend on is simply pulling our weight. And if a cooperative of our size can do it, much larger players can too.
How to Take Action?
These vulnerabilities were fixed because people devoted their days and nights to them. Next time, that might not be the case. If your business runs on PHP, sponsor the PHP Foundation, contribute to the projects you use, or set aside time for your teams. Digital commons have a cost, and today it is mostly their maintainers who are paying it.
It is also an opportunity for developers to level up their skills, understand the inner workings of languages, and take genuine pride in actively participating in the ecosystem. Everyone wins!
