Critical internet infrastructure increasingly relies on software maintained largely by unpaid or underfunded volunteers, raising concerns about the security and resilience of digital services that underpin governments and major corporations worldwide.
One such example is PHP, a widely used computer programming language that powers nearly 70 percent of websites, including prominent platforms like Wikipedia, WordPress, and Facebook, as well as numerous government portals. Maintained by a small non-profit foundation, the PHP project depends heavily on a combination of a single full-time employee and around 14 part-time contractors. Despite its global significance, the foundation operates on limited financial resources and relies primarily on volunteer contributions.
Earlier this year, the PHP team disclosed that a series of security vulnerabilities identified several years ago remained unpatched due to internal disagreements over the best way to address them. These vulnerabilities, if exploited, could have allowed hackers to seize control of websites built with PHP. Although known since 2021, the issues were initially set aside in favor of higher-priority tasks.
Last week, these security gaps were actively targeted following advancements in artificial intelligence-powered tools capable of rapidly detecting weaknesses in source code and accelerating the development of malware. As a result, emergency measures were required to take affected websites offline temporarily, disrupting services such as over 30 government platforms in the United Kingdom. Some automotive testing centers reverted to manual record-keeping amid the outage.
In a candid admission, the PHP Foundation acknowledged the delay in addressing the vulnerabilities as a "structural failure," attributing it to both decision-making processes within the security team and insufficient resources. The foundation urged increased support, stressing that large technology companies and governments benefit substantially from open source software but generally provide only a fraction of the funding necessary for its upkeep.
Industry analysts highlight the disproportion between the software’s economic impact and the modest investment in its maintenance. A 2024 study from Harvard Business School estimated the initial creation cost of critical open source software at $4.15 billion, while the replacement cost today could exceed $8.8 trillion. For example, the Federal German government allocates approximately €27 million annually to transition its systems to PHP but contributes only about €112,000 toward the language’s ongoing development.
The rise of AI not only identifies vulnerabilities more efficiently but also increases the volume of reports requiring evaluation. Since July, the PHP team has addressed 15 confirmed security issues but had to sift through over 100 submissions that were invalid, duplicates, or could not be reproduced—an operational strain exacerbated by limited manpower.
Experts warn that as more devices and critical infrastructure rely on interconnected software, the attack surface for malicious actors expands. Recent incidents, such as cyberattacks on French supermarket refrigeration systems, underscore vulnerabilities in everyday technology. Moving forward, some security professionals believe that AI-driven bug detection could strengthen open source projects, though improvements are expected to take years and may initially exacerbate challenges.
Calls are growing for greater investment and accountability in maintaining foundational digital tools, including reshoring supply chains and fostering partnerships with trusted allies. Meanwhile, expanding the funding and staffing of volunteer-led projects like PHP is seen as an urgent priority to safeguard the stability of essential online services.