PHP Foundation's thin staffing likely delayed PHP2Shell fix, report says

Reuters reports the PHP Foundation has just one full-time employee and 14 mostly part-time contractors, which likely delayed fixing the PHP2Shell vulnerability. The underlying out-of-memory flaw was found in 2024 but its fix stalled repeatedly. About 73% of PHP installations run end-of-life versions.

• PHP Foundation has one full-time staffer and 14 mostly part-time contractors
• The OOM flaw behind PHP2Shell was found in 2024 but fixes stalled for months
• About 73% of PHP installations run end-of-life versions
• 7.7% of PHP sites still run version 5.x, retired in 2018