Article · AI translation
Thanks to IT Home reader 华南吴彦祖 for the tip!
IT Home reported on October 25 that two high-severity vulnerabilities were disclosed in PHP this week, prompting urgent action worldwide to protect websites from hackers. The incident also showed how important this 30-year-old open-source programming language is to the internet.
By some estimates, as many as about 70% of websites worldwide are built on PHP, yet the nonprofit foundation responsible for maintaining it is severely short of funds.
“We have only 1 full-time employee, me, and 14 contractors, most of whom work part-time,” Elizabeth Barron, executive director of the PHP Foundation, said in an email interview on Friday local time. The foundation’s board members are unpaid volunteers, and its funding comes from donations and grants.
IT Home noted that the foundation has worked with outside researchers and several companies, including OpenAI, cybersecurity company Wiz, and Calif, to investigate security vulnerabilities and coordinate patch development. The fixes released on Wednesday resulted from that collaboration.
Cybersecurity provider Cloudflare said it had detected millions of attempted attacks. Barron, however, said the foundation had no evidence that hackers had successfully exploited the vulnerabilities before they were disclosed or had attacked websites that were already patched.
“We worked closely with OpenAI, Wiz, and Calif on this issue, and none of the organizations has reported any anomalies in patched systems,” she said.
Artificial intelligence has been both a help and a burden for the foundation. Researchers discovered these vulnerabilities, which had gone undetected for 10 years, with the help of AI. Barron also noted that AI has made programmers more productive.
At the same time, it has increased maintainers’ workloads. The PHP project now receives nearly twice as many proposed code changes as it did a year ago, “but the number of contributors has not doubled along with them.” Reviewing code submissions and vulnerability reports takes substantial human effort and relies on experienced judgment.
Barron said the recent incident illustrates how heavily businesses and governments depend on PHP. “Given how much everyone relies on it, PHP is clearly severely underfunded.”