The nonprofit foundation responsible for maintaining PHP, a programming language that underpins up to 70% of websites globally, operates with only one full-time employee, according to a recent report. Elizabeth Barron, the foundation’s executive director, confirmed via email that she is the sole full-time staff member. The organization also employs 14 contractors, the majority of whom work part-time, while its board members serve without compensation. The foundation’s funding relies primarily on donations and grants.

The foundation’s limited resources gained attention last week when researchers disclosed two critical vulnerabilities in PHP, which has been in use for over 30 years. These security flaws prompted an urgent global effort to safeguard websites from potential cyberattacks. In response, the foundation collaborated with external researchers and technology companies, including OpenAI and cybersecurity firms Wiz and Calif, to assess the risks and coordinate prompt remediation measures.

Barron emphasized that the incident underscored the widespread dependence of both private companies and government bodies on PHP. She described the foundation as “incredibly under-funded,” highlighting the challenges of maintaining such a vital piece of internet infrastructure with limited financial support.

Although web security firm Cloudflare reported millions of hacking attempts targeting the vulnerabilities, Barron noted that the foundation has found no evidence to suggest that attackers were able to exploit the flaws prior to their public disclosure or on systems that have since been updated. Additionally, at the time of reporting, OpenAI, Wiz, and Calif had not indicated any security breaches on patched websites.

The PHP foundation’s situation reflects broader concerns about the sustainability of critical open-source projects that support much of the internet yet often operate with minimal funding and staffing.