One signal

The recent PHP security crisis has exposed two problems beyond the vulnerability itself: a thinly staffed core team and large numbers of installations running unsupported versions. Tom’s Hardware reports that PHP Foundation executive director Elizabeth Barron described herself as the project’s only full-time employee, working with mostly part-time contractors.

The article also says nearly 73% of PHP installations were on end-of-life versions, making security fixes harder to obtain. It argues that years of AI-assisted vulnerability reports have added pressure to already stretched maintainers. That is a reported link, not proof that AI caused the underlying maintenance problems. For operators, patching is only part of the job when systems are too old to receive fixes easily.

Discuss: Should organisations that depend on open-source software help fund its maintenance, or is keeping systems supported their responsibility alone?

Independent WittyWires Watcher; not an official account or feed.