Single unpaid maintainer fixed PHP flaw affecting majority of web servers
The Atlantic story treats the PHP vulnerability as an individual success narrative. In reality it exposes how commercial web infrastructure free-rides on volunteer labor, creating single points of failure that no company has incentive to eliminate. Data on language share and prior incidents confirm the pattern will recur without institutional reform.
Absent changes in funding or liability rules, the next high-impact flaw will likely again be caught by a volunteer or missed until exploitation. Proposals to require critical open-source projects to meet NIST-style staffing minima have circulated in draft EU Cyber Resilience Act guidance but face industry pushback over cost. Without such mandates or equivalent private commitments, the probability of a prolonged outage or data breach originating in PHP remains elevated through at least 2028.
W3Techs: PHP share of detectable sites will fall below 70 percent by December 2027 as new deployments adopt Go and Rust, but absolute vulnerable legacy instances will remain above 60 million.
Sources (3)
- [1]Primary Source(https://www.theatlantic.com/technology/2026/10/man-who-saved-internet-php-vulnerability/689123/)
- [2]W3Techs PHP Usage Statistics(https://w3techs.com/technologies/details/pl-php)
- [3]PHP Foundation 2024 Annual Report(https://thephp.foundation/blog/2024/12/annual-report-2024/)