That free beer has a brewer

Two severe, unauthenticated remote-code-execution flaws in PHP expose the mismatch between software’s broad use and the resources sustaining it. The PHP Foundation, responsible for a runtime used by roughly seven in ten websites, has one full-time employee, 14 part-time contractors, and reported income of about $684,000 in 2024. The underlying problem is economic: information can be shared without being consumed, but buyers cannot assess its value before receiving it, and after receiving it may have no reason to pay. Hoarding and intellectual-property rules try to create scarcity and rewards; open source removes that scarcity but often leaves its labor unpaid.

That arrangement is becoming less sustainable as software consumption grows and AI-generated contributions increase review demands. PHP receives nearly twice as many proposed changes as a year earlier, without a comparable rise in reviewers. Well-funded projects such as OpenJDK are unusual; many crucial libraries still rely on volunteers or a single maintainer, leaving widespread systems exposed. Money is the strongest way to support maintainers, but bug reports, useful observations, and thanks also return value. A good report explains what happened, what was expected, and any workaround, while respecting the maintainer’s project goals. Companies that profit from open-source software should contribute more, and users should not mistake a zero price for zero cost. The immediate advice is to update PHP; the broader warning is that dependencies become liabilities when the people maintaining them cannot keep going.