PHP Core Security Audit Results(thephp.foundation)
thephp.foundation
PHP Core Security Audit Results
https://thephp.foundation/blog/2025/04/10/php-core-security-audit-results/
71 comments
>>> Last year, it received close to 680K USD, and managed this security audit, sponsored 10 developers, and paid for various expenses. For a language that runs close to 75% of the web, it certainly deserves more funding.
Wow, Automattic itself donated more than half of it: Silver Sponsor $387,500 USD
Why many donors with more than USD 24K and USD 100K still listed as Silver sponsor?
Source: https://opencollective.com/phpfoundation/contribute/major-sp...
Wow, Automattic itself donated more than half of it: Silver Sponsor $387,500 USD
Why many donors with more than USD 24K and USD 100K still listed as Silver sponsor?
Source: https://opencollective.com/phpfoundation/contribute/major-sp...
It feels pretty off that Laravel and Symfony, arguably the two largest benefactories to PHP being in such a good position have donated so little. Those contribution values are lifetime, Laravel hasn't funded it for over 3 years now, meanwhile its a multimillion dollar business with a huge amount of financial backing.
I know its all donations and not expected, but them kicking in ~$30k a month would realistically be nothing to them, but benefit the PHP foundation massively. The same goes for Symfony.
I know its all donations and not expected, but them kicking in ~$30k a month would realistically be nothing to them, but benefit the PHP foundation massively. The same goes for Symfony.
How's Symfony making money? Aren't they just OSS?
On the other hand Laravel has VC backing and sells services.
On the other hand Laravel has VC backing and sells services.
It's backed by SensioLabs (same creators as Symfony), plus theres a ton of sponsorship across the whole Symfony ecosystem. Every release is sponsored by multiple companies for example: https://symfony.com/backers
Symfony itself also had a round of funding many years ago when it wasn't rolling in cash, around $7 million if I recall.
Symfony itself also had a round of funding many years ago when it wasn't rolling in cash, around $7 million if I recall.
Crazy that Automattic only makes 4,843,750 a year (and donates 8% to the PHP foundation).
Automattic has annual revenue of over $700m where did you get that number from?
Ah, sorry, I assumed they contributed 8% to PHP just like they've asked WP Engine to contribute 8% (of their revenue) to them.
[deleted]
They are referring to the dispute between Matt Mullenweg / Automattic vs WP Engine.
Mullenweg has been demanding 8% of WP Engine’s revenue, access to their books, and the ability to direct their staff on what to work on. For context, Mullenweg is maintainer of WordPress and WordPress.org, and CEO of WP Engine’s direct competitor, Automattic. The dispute has turned very nasty and included a lot of unhinged behaviour from Mullenweg. WP Engine is currently suing him for a bunch of things, including extortion.
davidandgoliath is basically saying that if Mullenweg thinks he is owed 8% of WP Engine’s revenue, presumably Mullenweg is donating 8% of Automattic’s revenue to the PHP Foundation, making their revenue only ~$5MM/yr. Obviously Automatic’s revenues are vastly higher than that and this is just a tongue in cheek way of pointing out hypocrisy.
Mullenweg has been demanding 8% of WP Engine’s revenue, access to their books, and the ability to direct their staff on what to work on. For context, Mullenweg is maintainer of WordPress and WordPress.org, and CEO of WP Engine’s direct competitor, Automattic. The dispute has turned very nasty and included a lot of unhinged behaviour from Mullenweg. WP Engine is currently suing him for a bunch of things, including extortion.
davidandgoliath is basically saying that if Mullenweg thinks he is owed 8% of WP Engine’s revenue, presumably Mullenweg is donating 8% of Automattic’s revenue to the PHP Foundation, making their revenue only ~$5MM/yr. Obviously Automatic’s revenues are vastly higher than that and this is just a tongue in cheek way of pointing out hypocrisy.
"had annual revenue" at this rate given their legal troubles
Revenue is not profit.
While the 8% is probably a dig, the donation of .06% of revenue is going to be a much higher proportion of profits. No idea what their profits or margins are (a quick search does not provide useful info)
While the 8% is probably a dig, the donation of .06% of revenue is going to be a much higher proportion of profits. No idea what their profits or margins are (a quick search does not provide useful info)
[deleted]
That's since 2021 not last year.
In the GP's transparency report link, it said:
Overall, 658 organizations and individuals sponsored the foundation in 2024 through on Open Collective and GitHub Sponsors.
and in the Open Collective link, it is stated that Automattic donated those amount.
Overall, 658 organizations and individuals sponsored the foundation in 2024 through on Open Collective and GitHub Sponsors.
and in the Open Collective link, it is stated that Automattic donated those amount.
If you click on their name you can see the transactions. That's the total amount donated since 2021.
Why does Laravel have a dude with a Hawaiian shirt, though? Heh
It's the creator of Laravel, Taylor Otwell
People are calling him savior of PHP. :D
Shame his financial contribution doesn't really match up. $34k is pretty darn low considering how much money Laravel makes. Even worse when you see much smaller operatons like Private Packagist have donated more than Laravel and Symfony combined.
Is it true, though?
Serious question, I don’t participate much in PHP topics.
I'm a heavy PHP & Laravel developer and I speak for myself and a few close friends around my in my network who are like me. We all consider Laravel the reason we are still within the PHP scene and didn't move away. So in a sense I think it is true.
That said, the recent changes around Laravel (being bought out and becoming more and more commercial) is not something I (we) consider a good thing. Not necessarily a bad thing, but we all know that a OSS framework becoming commercial doesn't usually end well.
That said, the recent changes around Laravel (being bought out and becoming more and more commercial) is not something I (we) consider a good thing. Not necessarily a bad thing, but we all know that a OSS framework becoming commercial doesn't usually end well.
It's hyperbole, but like so often, there's a grain of it truth somewhere.
Also, like most things, Laravel is built on the shoulders of others. It sometimes makes hard things easy to access (ppl like this) and hides complexity away, clouding how things actually work (ppl don't like this).
I primarily use Laravel but like to think I code in a generalist if way as to not get stuck in its system.
Also, like most things, Laravel is built on the shoulders of others. It sometimes makes hard things easy to access (ppl like this) and hides complexity away, clouding how things actually work (ppl don't like this).
I primarily use Laravel but like to think I code in a generalist if way as to not get stuck in its system.
Laravel (when it started) was mostly built upon Symphony components, which in turn was inspired by Java frameworks.
It's about as divisive as saviours in any other population.
> "savior"
Ehh, I don't think I'd ever use that word but he had a huge impact on reinvigorating the PHP ecosystem as a whole with Laravel. I remember playing with early versions of Laravel on my own and having my eyes opened to a better way to structure/write code.
Ehh, I don't think I'd ever use that word but he had a huge impact on reinvigorating the PHP ecosystem as a whole with Laravel. I remember playing with early versions of Laravel on my own and having my eyes opened to a better way to structure/write code.
My take: no. He just has a cult following.
Mainly I want to say thank you. An incredible amount of work and dedication has gone into php over a very long period of time. The php community has managed to reinvent php several times, mainly just to make the language better. May they continue with their great success.
It's also important to understand how all these are achieved with so little ($683k donated in 2024) Considering how much php code is out there the budget php foundation has at its disposal is very small. I wished more companies sponsored.
I am genuinely interested why anyone would start a new project in PHP currently. What are the reasons?
I worked at a company that had half C#, half PHP developers. The PHP developers ran circles around them both in building features, and in fixing vulnerabilities (I was hired for a reason, legacy code). I can always depend on a PHP developer to outrun anyone else.
By the time a large C# solution finishes compiling, the PHP Dev already started another ticket and is pressing F5 to insta check if his code works so he can move to the third ticket of the day.
This hurts because it’s true and sometimes I’m jealous of the build kids who get to work on tiny features all day while I’m switching back and forth with a browser. I know native has its own challenges (looking at Apple here with the imminent redesign that will stop all product teams in their tracks) but it still doesn’t mean I’m not jealous sometimes
PHP is better than any of its alternatives within its problem space.
If all the other reasons given here don't convince you already, I have one more to offer: Match Expressions[1]!
[1]: https://php.watch/versions/8.0/match-expression
[1]: https://php.watch/versions/8.0/match-expression
That's a great one. On of the things I really enjoy when using Rust.
https://doc.rust-lang.org/reference/expressions/match-expr.h...
https://doc.rust-lang.org/reference/expressions/match-expr.h...
in a world where many projects are started with Python and Ruby, PHP has definitely a bright spot.
As mentioned by others, PHP today is not the PHP that is still in most peoples heads.
For me one of the big advantages is ease of deployment.
No docker, no images, no overhead, scp it to any toaster running apache and you are done!
But how do you install dependencies? Is the "it" you're scping a folder structure that includes them?
Dependencies are managed by Composer (like npm, cargo, etc) for more than 10 years now.
https://getcomposer.org
https://getcomposer.org
I was replying to the previous comment - how does this relate to that?
You asked how you install dependencies, they answered that question.
Because I‘m good in it. And my clients don‘t depend on me - they can choose to continue working with me not because I‘m the only one who knows how the language works, but because they WANT to.
it's pretty nice now, you don't even need a framework
While this is true, I would say that your advice only applies if you have experience with other web frameworks from other languages. If you’re coming at it blind to any sort of web development, the features afforded to you by a web framework are really useful and helpful to understand.
For example, imagine someone who had never really thought about routing in a definitions file versus file based versus annotations. Three valid use cases that might not exist if if you have a background in something like hardware or if you come from a non-programming discipline.
If you do have that experience, you can rebuild almost any affordance in PHP at this point and it purely comes down to personal preference and how you like to write and design with code.
For example, imagine someone who had never really thought about routing in a definitions file versus file based versus annotations. Three valid use cases that might not exist if if you have a background in something like hardware or if you come from a non-programming discipline.
If you do have that experience, you can rebuild almost any affordance in PHP at this point and it purely comes down to personal preference and how you like to write and design with code.
It's cheap, it's fast, it's simple, and it works everywhere.
The language has its quirks, but frameworks like Laravel make application / API development very easy. And, of course, it runs practically anywhere :)
TL;DR Your dad's PHP is no longer the current PHP. The language itself has been thoroughly modernized, made more consistent, bug free and performant. There is nothing better than a piece of software that keeps getting improved decade after decade borne out of real developer needs and experience.
- Type annotations are integrated and work well with PHP now. This results in a kind of scripty Java OOP that is more succinct and type checked ! (it is possible to write PHP without types when you want metaprogramming features also)
- Many inconsistencies in the design of the language (OOP, function naming etc.) have been resolved/smoothed out
- The language recognises the inherent problems with `null` and allows you to make type annotations that rule out null. This is my smell test for a language BTW -- golang for instance does not seem to have a good story for null.
- PHP Language developers have been really good about increasing performance year after year
- Lots of software like web frameworks and CMSes continue to be based on PHP
And -- the greatest part of the design -- PHP remains the best example of the "shared nothing" architecture. An architecture that allows you to scale your application easily.
- Type annotations are integrated and work well with PHP now. This results in a kind of scripty Java OOP that is more succinct and type checked ! (it is possible to write PHP without types when you want metaprogramming features also)
- Many inconsistencies in the design of the language (OOP, function naming etc.) have been resolved/smoothed out
- The language recognises the inherent problems with `null` and allows you to make type annotations that rule out null. This is my smell test for a language BTW -- golang for instance does not seem to have a good story for null.
- PHP Language developers have been really good about increasing performance year after year
- Lots of software like web frameworks and CMSes continue to be based on PHP
And -- the greatest part of the design -- PHP remains the best example of the "shared nothing" architecture. An architecture that allows you to scale your application easily.
> Your dad's PHP is no longer the current PHP.
I am pretty much in the "your dad" category here. Where best to start learning how PHP has changed since I used it?
There are things that appeal to be about PHP.
I am pretty much in the "your dad" category here. Where best to start learning how PHP has changed since I used it?
There are things that appeal to be about PHP.
Build something with symfony or laravel. In this space PHP is used in the modern way. Don't look at WordPress, Pimcore, WooCommerce et al. They're pretty much stuck with old PHP.
That said, you can still shoot yourself in the foot with PHP. The dark alleys are all still there.
That said, you can still shoot yourself in the foot with PHP. The dark alleys are all still there.
Thanks. I never want to look at WP again so that suits me :)
I looked at Symfony a few years back and it looked nice. if it has kept up with modern PHP it looks like a nice choice.
I looked at Symfony a few years back and it looked nice. if it has kept up with modern PHP it looks like a nice choice.
I would say that symfony is the base of modern PHP. Laravel and others can only be as beautiful as symfony is.
I legit started a new customer project (simple business website) on PHP a cple days ago:
The reason is simple: It's to me the most efficient, best performant SSR option out there, if your requirements are simple.
You will be amazed at the website's speed. We are so used to the lethargic JS slop of the average website out there these days.
I love PHP, I believe future "vibe coders" will be left bedazzled at its powers, which will be beyond their comprehension.
The reason is simple: It's to me the most efficient, best performant SSR option out there, if your requirements are simple.
You will be amazed at the website's speed. We are so used to the lethargic JS slop of the average website out there these days.
I love PHP, I believe future "vibe coders" will be left bedazzled at its powers, which will be beyond their comprehension.
Did you use any plain PHP or any framework?
plain in this case (would use a framework if i needed db, and perhaps auth)
Because it's good enough for almost everything. The vast majority of projects will never have to scale to billions of users, so hyperscalability is not a huge concern.
It has a low barrier to entry and great language features - static typing being one of the big ones. It has become a really nice language over the years, great to work in and in no way less satisfying or effective than for example golang.
And, of course, laravel exists.
It has a low barrier to entry and great language features - static typing being one of the big ones. It has become a really nice language over the years, great to work in and in no way less satisfying or effective than for example golang.
And, of course, laravel exists.
> The vast majority of projects will never have to scale to billions of users, so hyperscalability is not a huge concern.
I would have thought PHP would scale very well. It may not be high performance, but its start each request-response cycle from scratch should scale horizontally very well, surely?
I would have thought PHP would scale very well. It may not be high performance, but its start each request-response cycle from scratch should scale horizontally very well, surely?
It does. But scaling to billions of users (or billions of requests per day) is still not easy and you really need high performance for that. Laravel scales to a certain point, where their design decisions (eloquent, the queuing system etc.) are still working.
That said, with today's PHP it is possible to optimize the hot path pretty well with stuff like FFI.
That said, with today's PHP it is possible to optimize the hot path pretty well with stuff like FFI.
Correct, the real bottleneck is almost always the database.
> It has a low barrier to entry and great language features - static typing being one of the big ones
... and it's completely optional in many cases on top of that. Even if you're using third party libraries, it will only crash if you mess up your types at the library's interface.
... and it's completely optional in many cases on top of that. Even if you're using third party libraries, it will only crash if you mess up your types at the library's interface.
It just works and has batteries included.
Yep, nuclear batteries. Laravel and the whole PHP ecosystem is just so much ahead of any other programming language when it comes to building websites and APIs it's insane.
The real question would be why not ?
Many of the quirks and problematic parts have been addressed through the years, it's battle tested, and there is a healthy and stable ecosystem behind. It doesn't need to be everyone's first choice, but there's also no strong reason to avoid using it in its current state.
Many of the quirks and problematic parts have been addressed through the years, it's battle tested, and there is a healthy and stable ecosystem behind. It doesn't need to be everyone's first choice, but there's also no strong reason to avoid using it in its current state.
It just works out of the box, and request-response model still fits the web better than any other solution out there.
And it's still performant enough https://x.com/arvidkahl/status/1775261978006896730
And it's still performant enough https://x.com/arvidkahl/status/1775261978006896730
Especially if you use FrankenPHP!
[deleted]
This is good for php community.
Last year, it received close to 680K USD, and managed this security audit, sponsored 10 developers, and paid for various expenses. For a language that runs close to 75% of the web, it certainly deserves more funding.
Some of the recent initiatives from the Foundation (https://thephp.foundation/blog/2025/03/31/transparency-and-i...) :
- All PHP versions now receive a total of 4 years of security updates; 2 bug fixes + 2 security, up from 3.
- PIE: A replacement for PECL, to easily install PHP extensions (C, C++ compiled, not PHP packages).
- The security audit.
(I'm one of the PHP Core team and a volunteer at the foundation, happy to answer any questions, but almost all of the work is public)