It'd be really awesome, if more companies would sponsor the PHP foundation. The work of a few core maintainers is really crucial to the continued development of PHP.
The “community” has only just managed to find the resources to maintain NTP. I think if “nobody is donating” is your standard for whether things should live or die, then we are all hopelessly fucked.
Isn't there some large php based software run by a bruised ego who can't even get his own house in order, let alone help fund his largesse, but complains about his leeches.
The entire internet from that era is still built on it.
I worked at a major CDN with roots in the dot com era. PHP errywhere. You wanna log on and see your bill you're invoking like 40 different (modern containerized) lamp stacks.
I understand why people still have this perception, I imagine due to relics of the past of the PHP 5 (or earlier) era. But those days are long gone, and I believe PHP 8 has some a nice job of adding modern features and improving developer experience.
Wordpress is the obvious answer to your question, but its codebase is admittedly still stuck in the past in many ways. Nobody would write it that way if they were starting from scratch today.
There are plenty of “serious” companies using Laravel or Symfony. Take a look around those codebases if you want to get an idea of what solid modern PHP design patterns look like nowadays. Nothing “cheap or not very technical” about them :)
Some Amazon sites, they said. Lots of random companies and institutions: a Danish IT company, a Dutch cybersecurity company, Orange telecoms (in France). Various governments' sites for various services. Some BBC TV show pages, a gym group, a Japanese airline, Asahi (the brewers), Finland's state IT provider.
She says the full-time member is herself, and looking at her Linkedin (in/elizabethn) she isn't exactly the person who would patch PHP for the two CVEs.
Beating the dead horse, as you are: the Bun Rust migration cost millions of dollars in tokens and took an additional 3.5 months of labor after the widely-marketed "11-day rewrite" before being shipped as a release, and in the process introduced hundreds of new issues.
migrating to what? just take a look at the newest CVEs, https://www.tenable.com/cve/newest , and you will see that no technology is spared by high or critical reports.
Sure if you ignore the many governments around the world that use PHP, the (still) most popular blogging software (which also has several ecommerce solutions bolted on top), wikis. The list goes on.
A pet peeve of mine is when people offer simple solutions that are only simple by virtue of ignoring all use cases that don't matter to the author.
Come on Facebook/Zuckerberg, set them up with a structured fund that is invested in s&p500 or something equivalent/better and allows them to pay a handful of devs and a person to admin them (all surplus can be earmarked to go to charity to avoid the sinkhole of bureaucracy from a larger org). Would set the PHP Foundation up for life and the whole world would be better off as a result, smallish directed investment with huge payout from a value perspective.
And then people complain about "bait and switch " or "pulling the rug" when an OSS project becomes successful and tries to fund itself in some way. "But that should be free" shouts everyone. I'm increasingly under coming around to the idea that OSS was the biggest swindle the corporations managed to pull off.
I've been shouting this from the rooftops for ages now. OSS is a trojan horse, something meant to devalue the work of independent developers/small businesses and ensure that the only way the software can be supported is through the patronage of big tech, who earn the money to control such OSS through their unethical monopolistic practices. Look at the languages with funding, and where it comes from. C and C++ (both LLVM and GCC), C#, JS/TS, Java, Rust, Go, Python are all directly funded by big tech. The naive idealism results in everything falling into the hands of ~10 corporations plus some VCs who gamble on which ones will become worth acquiring by big tech, and then we wonder why everything goes to shit and our entire ecosystem is so user-hostile.
I'm not saying that big tech isn't hijacking open source software, but that does not mean that free or OSS was always "meant to devalue" devs or small companies.
Until very recently, big tech pumped untold millions of dollars into obliterating FLOSS altogether, calling it a cancer that will destroy any enterprise it touches.
You mean just Microsoft. Microsoft was an outlier. Even in the 90s, Linux and GCC were being funded by big tech. Obviously they were developed with the best of intentions, but I think it's accurate to say that OSS is "meant" to devalue developers because the purpose of a system is what it does, and that is what it does in practice.
"The purpose of a system is what it does" is the weirdest cliché I encountered here, and that's not just because it is horoscope nonsense dressed up as a fact, but because it brilliantly illustrates how many people here think they just know what a system does on a glance.
But if it was true: In the 90s, millions of small businesses around the world used FLOSS to host websites and offer services over the internet. That was decidedly not the route big enterprises wanted to go. They wanted to push through big standards through ITU et al, build giant, patented moats, and host it all on big mainframes with huge Oracle databases.
Even today, there exist small to medium businesses in the hosting and shopware space, and they can only do that because big tech could not push them out of that space because FLOSS protected them.
I can't speak for anyone else, but I don't mind at all when an open source project switches licenses or whatever. They gave away the fruit of their labor, but I am not entitled to any more of it.
What does bother me is when the projects pivot to claiming that users now have a moral obligation to financially support the project. There is a kind of dishonesty in this move.
It's not that a successful project "should be free", it's that its success depended on it being free. If they had said all along that they'd eventually ask users to pay, that would be honest... but then they wouldn't have seen much of that adoption in the first place.
> I can't speak for anyone else, but I don't mind at all when an open source project switches licenses or whatever. They gave away the fruit of their labor, but I am not entitled to any more of it
It only bothers me when they try to claim their new license is open source or use misleading language when it isn't. Which seems to be what 90% companies doing that do.
People can do whatever they want with their intellectual property as long as they aren't lying about it.
Select the right OSS license and use dual licensing.
GPL/AGPL/LGPL is the way to go for business. There are many dual-licensing success stories using GPL/AGPL, both large and small: Qt, iText, Grafana, Loki, Tempo, Mattermost, Cal.com, Baserow, and even MongoDB originally.
Qt is an especially interesting case because KDE and the Qt Company have a written contract. Qt can't just switch licenses. They have retreated from every voluntary contribution to open source, but the contract binds them and they can't do anything to it unless they do complete rewrite from scratch.
> There are no incentives for anyone to contribute
If you like PHP, you might want to contribute. I like tmux, for instance, and I contributed code to them. I did the same for Sysdig, and a couple other projects.
I like a lot of things as well, yet I don't feel I can contribute after work. I already spend 8 to 10 hours at work. I can't find the motivation to do more.
I don't understand the question. Greed exists in every human system because it's a human quality, not a system quality. Real people are driven by many, sometimes conflicting things at the same time.
Agreed the budgets doens't seem like a lot, I wonder if in addition to some companies that make a lot of money using PHP funding a little, there are some opportunities to use grants or free services for nonprofits?
I noticed bills for both Workspace and GitHub (admittedly small amounts for Workspace, less small for GitHub)
This has long been an issue with open source projects.[0] If it were up to me, the government (any government) would fund every important project out there. It would be very cheap, and the payoff will be enormous.
If Automattic funded the PHP Foundation with 8% of their revenue [1], like what Matt Mullenweg asked from companies using WordPress [2], the PHP Foundation would have lots of money.
I take your point and it’s not 8% of their revenue, I guess, but they do give the PHP Foundation a quarter of a million dollars a year. AFAIK they are the biggest contributor?
If governments had to take down websites waiting for the patches this week then there are important users of php out there who have the money and should be contributing. I think php needs better public relations and people who can knock on the right doors to get funding.
83 comments
[ 0.25 ms ] story [ 22.2 ms ] threadSecurity improved one blockbuster vuln at a time.
Closed source might have more money but they almost never invest it in security.
https://opencollective.com/phpfoundation/transactions?search...
(seems like "work" selects most of that)
And it's not cheap to pay that many people, especially not full time. According to https://opencollective.com/phpfoundation#category-BUDGET they only have a balance $350k currently, sinking.
It'd be really awesome, if more companies would sponsor the PHP foundation. The work of a few core maintainers is really crucial to the continued development of PHP.
Plenty of companies can donate 0.1 engineers to work on php, if for no other reason than to make php better for their own use cases.
It overwhelmingly seems like the language of the cheap and not very technical or providers of services to the cheap and not very technical.
They recently posted about how to patch their software from the command-line (https://www.netgate.com/blog/critical-php-security-update)
Hrmmm.
I worked at a major CDN with roots in the dot com era. PHP errywhere. You wanna log on and see your bill you're invoking like 40 different (modern containerized) lamp stacks.
Wikipedia
Wordpress
Wordpress is the obvious answer to your question, but its codebase is admittedly still stuck in the past in many ways. Nobody would write it that way if they were starting from scratch today.
There are plenty of “serious” companies using Laravel or Symfony. Take a look around those codebases if you want to get an idea of what solid modern PHP design patterns look like nowadays. Nothing “cheap or not very technical” about them :)
There were a lot of sites affected by the later exploits, so I will say, yes.
And who's to say whatever sites are migrated to won't be "sunsetted" in a few decades too?
Seems like a no-brainer to maintain it.
A pet peeve of mine is when people offer simple solutions that are only simple by virtue of ignoring all use cases that don't matter to the author.
(You need to address one specific company, because if you address two, neither will give you a cent, expecting the other to pay.)
Until very recently, big tech pumped untold millions of dollars into obliterating FLOSS altogether, calling it a cancer that will destroy any enterprise it touches.
But if it was true: In the 90s, millions of small businesses around the world used FLOSS to host websites and offer services over the internet. That was decidedly not the route big enterprises wanted to go. They wanted to push through big standards through ITU et al, build giant, patented moats, and host it all on big mainframes with huge Oracle databases.
Even today, there exist small to medium businesses in the hosting and shopware space, and they can only do that because big tech could not push them out of that space because FLOSS protected them.
What does bother me is when the projects pivot to claiming that users now have a moral obligation to financially support the project. There is a kind of dishonesty in this move.
It's not that a successful project "should be free", it's that its success depended on it being free. If they had said all along that they'd eventually ask users to pay, that would be honest... but then they wouldn't have seen much of that adoption in the first place.
It only bothers me when they try to claim their new license is open source or use misleading language when it isn't. Which seems to be what 90% companies doing that do.
People can do whatever they want with their intellectual property as long as they aren't lying about it.
GPL/AGPL/LGPL is the way to go for business. There are many dual-licensing success stories using GPL/AGPL, both large and small: Qt, iText, Grafana, Loki, Tempo, Mattermost, Cal.com, Baserow, and even MongoDB originally.
Qt is an especially interesting case because KDE and the Qt Company have a written contract. Qt can't just switch licenses. They have retreated from every voluntary contribution to open source, but the contract binds them and they can't do anything to it unless they do complete rewrite from scratch.
If you like PHP, you might want to contribute. I like tmux, for instance, and I contributed code to them. I did the same for Sysdig, and a couple other projects.
I noticed bills for both Workspace and GitHub (admittedly small amounts for Workspace, less small for GitHub)
https://www.google.com/nonprofits/eligibility/
https://github.com/solutions/industry/nonprofits
[0]https://www.fordfoundation.org/learning/library/research-rep...
[1] https://www.reddit.com/r/Wordpress/comments/1g6qi8i/automatt...
[2] https://techcrunch.com/2026/02/12/automattic-planned-to-targ...
https://www.therepository.email/automattics-anne-mccarthy-jo...
https://x.com/ThePHPF/status/1853390265429508427