PHP Foundation

In May 2021, after PHP core developer Joe Watkins published his blog post “Avoiding Busses,” JetBrains began discussing the idea of a PHP foundation with Watkins and other PHP community members including Sebastian Bergmann and Stefan Priebsch; Bergmann and Priebsch had attempted to start a similar foundation in 2019. At first the parties were in no hurry, but the work intensified markedly after Nikita Popov decided that year to leave JetBrains.⁠[1][1][1]

On November 22, 2021, JetBrains published an announcement on its blog, signed by Roman Pronskiy, that it was joining with Automattic, Laravel, Acquia, Zend, Private Packagist, Symfony, Craft CMS, Tideways and PrestaShop, ten companies in all, to form the PHP Foundation. The immediate trigger was the departure of major PHP contributor Nikita Popov from JetBrains on December 1 to focus on LLVM; JetBrains said that losing such a contributor put PHP in a fragile position (the “bus factor” problem).⁠[2][1][1][1][1][1]

The foundation was set up as a non-profit organization whose mission is to ensure the long life and prosperity of the PHP language; to start quickly, the parties chose to operate through Open Collective, which handles legal and accounting matters. Based on the participating companies’ pledges, the foundation expected to raise about $300,000 per year, with JetBrains planning to contribute $100,000 annually.⁠[1][1][1]

A temporary administration was put in place at launch, made up of sponsor representatives and veteran PHP developers including Rasmus Lerdorf, Dmitry Stogov, Joe Watkins, Sara Golemon, Derick Rethans, Sebastian Bergmann and Nikita Popov, to draw up rules and bylaws. The foundation’s primary task was to pay developers to work on PHP; any php-src contributor could apply for part-time or full-time funding during a 28-day application period. The announcement also stated that the existing RFC process would not change and that language decisions would always be left to the PHP Internals community.⁠[1][1][1][1][1]

In January 2022, the foundation published its first monthly update: the first round of funding applications had closed, and the JetBrains legal department and Open Collective staff were helping prepare contracts and other paperwork; the administration had held three meetings, with decisions documented on GitHub. Besides the founding companies, RAKUS, Livesport, OP.GG, Shopware, Aternos and others had each donated $10,000 or more.⁠[3][3][3][3]

The foundation received about 100 applications between November and December 2021 and chose six developers with proven track records: Arnaud Le Blanc, Derick Rethans, Gina Peter Banyard, Ilija Tovilo, Jakub Zelenka and Máté Kocsis. Contract negotiations lasted until March 2022, and from April the six were paid hourly as freelance contractors, initially on six-month contracts, switching to yearly contracts from 2023.⁠[2][2][2][2][2]

When its first Impact and Transparency Report was published in November 2022, the foundation consisted of 10 volunteer administrators and 6 part-time paid developers; it had received $580,000 in donations from organizations, and 1,400 people had backed or donated individually. From April to November 2022, foundation developers made 683 commits and 283 reviews in the php/php-src repository, nearly half of the repository’s commits and reviews. The report set out planned spending of $678,000 for 2023. The same year, the foundation won the Next Generation Award at the Open Source Awards by All Things Open.⁠[2][2][2][2][2][2]

In March 2023, the foundation opened a GitHub Sponsors page; funds received there are transferred to Open Collective monthly, and developers continue to be paid through Open Collective. It also created an Advisory Board as a channel of communication between sponsors and the foundation team, to help set priorities for the use of developer time and resources; the foundation stressed that all language decisions go through the RFC process, which is not affiliated with the foundation.⁠[4][4][4][4][4]

In November 2023, the foundation announced work plans drawn up with Germany’s Sovereign Tech Fund (funded by the German Federal Ministry for Economic Affairs and Climate Action) for four projects: a PECL overhaul, a testing tool for FPM, a security audit and documentation improvements. The security audit of PHP’s C code base would be carried out in partnership with the non-profit Open Source Technology Improvement Fund (OSTIF); the foundation said it expected security issues to be found and aimed to publish and fix them at the same time.⁠[5][5][5][5][5]

In the same period, the foundation ran an open call for new developers, received 207 applications and selected four. Since its creation that March, nine companies including Moodle, Shopware, Laravel and PrestaShop had joined the Advisory Board, whose feedback significantly shaped the design of the Property Hooks RFC.⁠[5][5][5][5][5]

In 2024, PHP underwent its first external security audit in years: the foundation obtained funding from Germany’s Sovereign Tech Agency, OSTIF organized the audit and the security firm Quarkslab carried it out over two months, covering threat modeling, manual code review, dynamic testing and cryptographic assessment; because of budget constraints, it covered only the most critical parts of the PHP source code.⁠[6][7][7]

While fixing one of the issues Quarkslab reported, a PHP core developer funded by the foundation found the first signs of an out-of-memory (OOM) handling problem, the issue later tracked as CVE-2026-109618. In 2024 a potential exploit was theorized, but no concrete attack vector was found, and other issues with clear impact drew attention away from it.⁠[6][6]

In January 2024, four developers, David Carlier, James Titcumb, Saki Takamachi and Shivam Mathur, joined part-time, forming the foundation’s development team together with the six contracted since April 2022.⁠[8][8]

In April 2024, the PHP Foundation, the Apache Software Foundation, the Python Software Foundation, the Rust Foundation and other open source organizations announced a collaboration hosted by the Eclipse Foundation to create specifications for secure software development, rooted in open source best practices, in line with the European Union’s Cyber Resilience Act.⁠[9][9][9]

In November 2024, the foundation released a pre-release of PIE (PHP Installer for Extensions), intended to replace PECL by distributing extensions through Packagist like ordinary PHP packages; PIE’s development was commissioned by the Sovereign Tech Agency.⁠[10][10][10][10]

On its third anniversary, the foundation noted that before its creation only two people had been paid to work on PHP, whereas it now had 10 engineers; the foundation team had contributed to three releases, PHP 8.2, 8.3 and 8.4, developing features such as property hooks, asymmetric visibility and lazy objects, and said feature development made up only about 20% of the team’s work. Other results in this period included growth of more than 51% in total contributions to the PHP repositories, the first external security audit of PHP in ten years, and a one-year extension of security support for PHP versions.⁠[11][11][11][11][11][11]

In April 2025, the foundation published the results of the php-src security audit commissioned by the Sovereign Tech Agency and carried out by Quarkslab: it found 27 issues, 17 of them with security implications (3 high, 5 medium and 9 low severity), plus 10 informational findings; four vulnerabilities received CVE identifiers, including CVE-2024-9026, a log tampering vulnerability in PHP-FPM, and CVE-2024-8925, a flaw in multipart form data parsing. The foundation said the PHP development team had addressed all of the issues.⁠[7][7][7][7][7]

In May 2025, the foundation announced official support for FrankenPHP, the PHP application server created by Kévin Dunglas and sponsored by Les-Tilleuls.coop, committing to contribute to its development and to host its code in PHP’s official GitHub organization, while governance stays with the original maintainers.⁠[12][12]

In September 2025, the foundation announced that it was working with AnthropicAnthropicAnthropic is an artificial intelligence research and product company founded in 2021 that develops the Claude models, assistant, and tools such as Claude Code, and operates as a public benefit corporation. Dario Amodei and Daniela Amodei are its co-founders, and its research covers model safety, interpretability, and steerability.Open the full entry’s MCP team and Symfony on the official PHP SDK for the Model Context Protocol, with the Symfony team as lead maintainers.⁠[13][13]

The same month, Joe Watkins, who had helped establish the foundation, joined as a contract developer for the second half of 2025. He said the foundation had been set up to raise PHP’s “bus factor,” which was no longer a major concern, but that it had not yet produced a roadmap, and that he hoped to act as a conduit between sponsors and developers.⁠[14][14][14][14][14]

In November 2025, the foundation announced that founding Executive Director Roman Pronskiy would step down in early 2026 to focus on his role at JetBrains, while remaining on the board as JetBrains’ representative; the board formed a search committee of Sebastian Bergmann, Nils Adermann and community representatives Lorna Jane Mitchell and Ben Ramsey. The job description stated that the Executive Director would be engaged as a contractor of Open Source Collective, with total compensation of $90,000 to $160,000.⁠[15][15][15][15][15][15]

On February 27, 2026, the foundation announced Elizabeth Barron as Executive Director. Barron co-founded a volunteer-based nonprofit supporting women and non-binary people in the PHP industry, served as Community Manager at GitHub, where she led developer outreach programs including the Patchwork initiative, and has been active in CHAOSS, a project on open source community health metrics.⁠[16][16]

In March 2026, Laravel expert Matt Stauffer joined the board as a community representative after a vote by the existing board members.⁠[17][17]

In May 2026, the foundation announced a grant from Alpha-Omega and the creation of a PHP Ecosystem Security Team to help maintainers across the PHP ecosystem triage vulnerability reports, disclose vulnerabilities responsibly and adopt security tooling. The foundation noted that new AI-based security tools were accelerating vulnerability discovery, while many projects were seeing a drastic increase in vulnerability reports, many bearing the hallmarks of “lazy AI generation.”⁠[18][18][18][18][18]

The grant funds a six-month full-time position, “Ecosystem AI Security Engineer in Residence at the PHP Foundation,” which the board voted unanimously to offer to Volker Dusch, one of the PHP 8.5 release managers.⁠[18][18][18]

In 2025, the PHP project shipped PHP 8.5 with the foundation’s support; the foundation launched PIE 1.0 and began a project to modernize PHP’s streams layer, and its developers authored roughly 42% of all commits to PHP’s core; sponsors and individual donors contributed a total of $730,534 that year. At the end of 2025, the foundation consisted of 8 volunteer board members, an Executive Director sponsored by JetBrains and 11 contracted developers. The annual report the foundation published in May 2026 also reiterated that it does not control the PHP community’s decisions about the language and assumes no governance over the language itself.⁠[19][19][19][19]

In July 2026, the foundation said that AI tools had markedly increased the number of security reports submitted to php-src and that only a very small team was handling them, and it engaged Alexandre Daubois, CTO of Les-Tilleuls.coop, to spend a few hours a week helping triage, handle and fix security reports.⁠[20][20][20]

In August 2026, the board unanimously added Anne McCarthy, Architect and Open Source Director at Automattic, as a platinum sponsor representative.⁠[21]

The foundation got PHP into the Patch the Planet program, under which the security firm Calif began auditing PHP on July 30, 2026. On August 11, Calif researcher Ryan A reported an unconditional remote code execution vulnerability with the same root cause as the OOM problem the foundation had found in 2024; OpenAI independently reported the same root cause, and Wiz and OpenAI reported further attack vectors on August 24 and September 18 respectively. The foundation said these reports made the full impact of the OOM problem clear, and from August 11 fixing it became the top priority for the foundation’s security team, with several people working on it full time, eventually through weekends and around the clock.⁠[6][6][6][6][6]

In September 2026, as Roman Pronskiy’s term ended and he left the board, Brent Roose, developer advocate for PHP at JetBrains, was unanimously voted in by the existing members to fill the JetBrains Platinum Sponsor seat.⁠[22][22][22]

The same month, Daniel Scherzer, a PHP 8.5 release manager and maintainer of the Reflection extension, joined the Ecosystem Security Team on a short-term basis under the Alpha-Omega grant to work on issues that harden PHP but do not qualify as security vulnerabilities.⁠[23][23][23]

In October 2026, Alexandre Daubois wrote about how the PHP security team works: the team is made up of community members and foundation-funded developers and runs separately from the foundation, with the foundation’s Ecosystem Security Team working alongside it; since July 1 the team had published 15 CVEs and closed 106 reports found to be invalid, duplicates or not reproducible. The PHP Group has been a CVE Numbering Authority with php-src as its scope since 2019 and assigns its own CVE IDs.⁠[24][24][24]

Under the coordinated disclosure, the fixed releases were scheduled for 14:00 UTC on October 22, 2026. At around 15:00 UTC on October 20, the two CVE IDs began circulating on online forums and social media, with a wrong release time and a wrong CVSS score of 10.0 (the actual score was 9.2), but no technical details leaked. The PHP project brought its pre-announcement forward to 19:30 UTC and moved the release one day earlier, to 14:00 UTC on October 21.⁠[6][6]

After the pre-announcement, Calif, which had reported the vulnerabilities, mistakenly published a video showing its proof of concept working; copies kept circulating on social media after it was deleted, accelerating the development of various proof-of-concept exploits. At 07:41 UTC on October 21, more than six hours before the coordinated release, Chainguard unilaterally broke the embargo and published images containing the fix; the foundation criticized this as letting attackers study the fix in binary form while other users were still waiting.⁠[6][6][6][6]

On October 21, 2026, the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, fixing two critical vulnerabilities that can let unauthenticated attackers execute code on servers. CVE-2026-109618 arises because out-of-memory handling can interrupt PHP while internal request data is only partially initialized; on Apache with mod_php, an unauthenticated request can trigger it before any application code runs, and full remote code execution was demonstrated with default settings. CVE-2026-109619 arises because request-owned internal state can survive after its memory has been freed, so a later request may use that stale state. All PHP installations serving web requests are at risk, with mod_php at highest risk; the PHP project said there are no complete mitigations and updating is the only safe choice.⁠[25][25][6][25][25][25][25]

The same day, the foundation published an account of the fix: both vulnerabilities sit in memory management and error handling, parts of PHP that nearly every request touches, which made them both serious and hard to fix without breaking compatibility, hurting performance or forcing changes on many third-party extensions. For the OOM problem, the PHP security team developed several competing approaches, each with its own trade-offs; operating on consensus, the team struggled to choose and feared the repercussions of shipping the wrong one, and with no known path to remote code execution at the time and only a small, busy group of core developers with deep knowledge of the engine, work on a fix stalled and restarted repeatedly over months. The foundation wrote: “We won’t pretend otherwise: the delay was a structural failure, caused by both the security team’s decision process and its lack of resources.”⁠[6][6][6][6][6][6]

The foundation said the security team had begun changing its processes so that decisions can be made by majority and compromises are encouraged, and that a serious vulnerability whose fix is stuck on hard trade-offs would now reach foundation leadership much sooner. It also said it had earlier worked with Alpha-Omega to scan PHP with Anthropic’s Claude Mythos and had since added other tools, including OpenAI’s Daybreak Red, to validate reports and exploits. The foundation called on companies, hosting providers, cloud platforms and government institutions that depend on PHP to provide sustained funding, saying security work on PHP itself still depends on a small group of foundation-funded developers and a little volunteer help.⁠[6][6][6][6][6]

The foundation’s work is carried out by four parts: the Governing Board sets strategic direction and makes final decisions; the Executive Director manages day-to-day operations and bridges the board and the developers; the Advisory Board, made up of major sponsors and invited community figures, gives feedback without decision-making authority; and contracted developers carry out technical work such as core PHP development and bug and security fixes. The board has 5 to 10 members, with up to 3 seats for Platinum sponsors and at least 3 for community representatives; directors serve 3-year terms on a voluntary, unpaid basis. Regular matters pass by simple majority, while strategic matters require a two-thirds majority of the whole board.⁠[26][26][26][26][26][26][26]

The foundation uses Open Source Collective, a 501(c)(6) non-profit organization based in the United States, as its fiscal host, which handles financial transactions, donations and legal compliance. As of October 2026, board members included Sebastian Bergmann, Nils Adermann (Private Packagist), Benjamin Eberlei (Tideways), Nicolas Grekas (Symfony), Sara Golemon, Matthew Weier O’Phinney (Perforce), Matt Stauffer, Anne McCarthy (Automattic) and Brent Roose (JetBrains), and the Executive Director was Elizabeth Barron; the foundation contracts 13 full-time and part-time engineers, and Rasmus Lerdorf, Dmitry Stogov and Nikita Popov are PHP Fellows.⁠[26][15][27][27][27][27][27][27]

The foundation’s income comes from corporate members and individual donors: corporate membership has three tiers, Silver ($12,000 per year), Gold ($24,000 per year) and Platinum ($100,000 per year), and Silver and above receive an Advisory Board seat. As of October 2026, the public Open Collective accounts showed about $3.055 million raised and about $2.703 million disbursed in total; the largest institutional contributors were Automattic ($762,500), JetBrains (about $477,000), the Sovereign Tech Fund (about $214,000) and the Linux Foundation ($183,500).⁠[28][28][28][28][29][29]

PHP Foundation: Official website: https://thephp.foundation/ (opens in a new window).⁠[30]

X: Public account: https://x.com/thephpf (opens in a new window)⁠[31]

LinkedInLinkedInLinkedIn is a social networking platform for professionals. It was founded in 2002 by Reid Hoffman and others, launched in 2003, and listed on the New York Stock Exchange in 2011; after Microsoft acquired it for approximately $26.2 billion in 2016, it became a wholly owned Microsoft subsidiary. Its revenue comes from membership subscriptions, advertising, and recruitment solutions.Open the full entry: Public profile: https://www.linkedin.com/company/phpfoundation/ (opens in a new window)⁠[31]