The Single Full-time Employee Trying to Shield 70% of the Web From AI-Driven Exploits

PHP Foundation Executive Director Elizabeth Barron told Reuters on Friday, October 23, that the nonprofit behind a language used by up to 70% of websites has one full-time employee, herself. 

Her remarks follow a week of emergency patching for flaws that researchers found with AI tools, as we reported earlier. 

Experts warn the episode shows how AI makes bugs easier to exploit, and PHP has since disclosed another unpatched flaw, CVE-2026-115560. For site owners, the question is who has the capacity to fix the next one.

What Elizabeth Barron Says the PHP Foundation Can and Cannot Do

Barron’s description was blunt: “one full-time staff member (that’s me) and 14 mostly part-time contractors.” Board members are unpaid volunteers, and funding comes from donations and grants, she told Reuters. 

Financial records reportedly put the foundation’s annual budget near $973,000.

The foundation leans on outside partners. It works with OpenAI and the Google-backed security company Wiz and AI firm Calif to investigate flaws and coordinate fixes, including this week’s patches. 

Barron said it has no evidence that hackers exploited the flaws before disclosure or on patched sites, even though Cloudflare reported millions of attempts.

AI has added to the load. Proposed code changes have nearly doubled in a year, she said, while contributors have not, and reviewing contributions and bug reports still demands heavy human experience. 

Barron called PHP badly underfunded given how much companies and governments rely on it.

How AI Turns Old Bugs Into Exploitable Ones

Wired’s reading is that the exposure was avoidable. 

A security company’s decision to release details early left much of the web open to attackers, which is clearly a preview of what AI-era disclosure can cost. 

The timeline backs the point. The Wiz and Calif reported the flaws to PHP’s developers in August, discovered using OpenAI tools, CNBC reports, and fixes shipped on October 21, a day after the early disclosure.

Speed of discovery is the other half. Calif reportedly pointed a large language model at PHP on July 30 and found an attack method by August 1. More vulnerabilities were also discovered after that.

Talking about speed, Wiz says one researcher with frontier AI finished in a week what once took a world-class team months. The models can adapt an exploit to different PHP versions, configurations, and memory layouts. 

Why PHP’s Staffing Gap Matters for the Next AI-Found Flaw

Set the numbers side by side. Calif found its route in two days, and OpenAI says the PHP flaws are among several serious vulnerabilities it has found. 

On the other side of the pipeline sit one salaried employee and a review queue that has nearly doubled. 

AI is indeed helping researchers file thousands of bugs, swamping projects like PHP. And the third flaw shows what that looks like. 

PHP disclosed CVE-2026-115560 two days after the emergency patches. Those releases do not fix it, it needs an unusual session setup, and it will wait for a routine release, with interim advice to disable session upload progress.

Reports say OpenAI funded the audit that found the PHP2Shell flaws, while the foundation that must review and ship fixes runs on donations and grants. 

Anthropic’s Jason Clinton has warned of a coming “vulnerability tsunami.” PHP shows who would absorb it: a team of 15, mostly part-time.

Source: PHP Foundation ‘under-funded’ with one full-time staff member, director says