Home / Articles / The maintenance deficit, with evidence / Versions / v1.1.0
The maintenance deficit, with evidence: what changed in v1.1.0
From v1.0.0 (2026-10-23, f5c74c22f) to v1.1.0 (2026-10-23, this release), paragraph by paragraph.
3 paragraphs added, 2 removed, 8 changed in place, 43 unchanged. About 377 words added and 333 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
1 unchanged paragraph
Summary: Dion Wiggins has written the piece I wish I had written about php2shell. He puts a number on something I have been arguing for months: Germany spends about €27 million a year on its federal website platform, built on PHP, and contributed about €112,000 a year to PHP's security, a maintenance deficit ratio of 241 to 1. Then he walks the same gap through the rest of the stack governments are migrating onto. This is a follow-up with our evidence. I checked his main figures against their primary sources: the order of magnitude holds under every cut, from 179 to 263 to 1, and a few details differ, which I list. I add what our evidence vault and the PHP story's site show two days on: 751 downstream products in the Dutch inventory, only 109 of them fixed; no named organisation saying it was compromised through these flaws, and the US catalogue of exploited flaws still not listing them; and an independent assessment of the incident, built in a day by a team of agents. Then the argument: this is not a story about generosity. Open source's business model pays the integrator, the host and the platform, and almost never the maintainer or the packager, and AI has just made the discoverers richer than the people who have to fix what they find. The money exists; what is missing is a model that pays for maintenance as the product.
[figure dw-built-on-volunteers.webp] "Built on volunteers: €108 million for the building, €112,000 for the foundation." Dion Wiggins' illustration for his article: a building labelled Digital Sovereignty, lifted by a crane carrying the €108 million contract, resting on a cracked column of PHP, OpenSSL, curl, FFmpeg, libxml2, core-js and pgBackRest, held up by volunteers, beside a jar of $730,534 from 536 donors and a sign saying 11 part-time engineers on duty, while an official with binoculars holds a €2 billion, seven-year sovereignty package. Reused from his public post, with credit. | wide
Summary: Dion Wiggins has written the piece I wish I had written about php2shell. Dion puts a number on something I have been arguing for months: Germany spends about €27 million a year on its federal website platform, built on PHP, and contributed about €112,000 a year to PHP's security, a maintenance deficit ratio of 241 to 1. Then Dion walks the same gap through the rest of the stack governments are migrating onto. This is a follow-up with our evidence. I checked the main figures against their primary sources: the order of magnitude holds under every cut, from 179 to 263 to 1, and a few details differ, which I list. I add what our evidence vault and the PHP story's site show two days on: 751 downstream products in the Dutch inventory, only 109 of them fixed; no named organisation saying it was compromised through these flaws, and the US catalogue of exploited flaws still not listing them; and an independent assessment of the incident, built in a day by a team of agents. Then the argument: this is not a story about generosity. Open source's business model pays the integrator, the host and the platform, and almost never the maintainer or the packager, and AI has just made the discoverers richer than the people who have to fix what they find. The money exists; what is missing is a model that pays for maintenance as the product.
[figure dw-built-on-volunteers.webp] "Built on volunteers: €108 million for the building, €112,000 for the foundation." Dion Wiggins' illustration for the article: a building labelled Digital Sovereignty, lifted by a crane carrying the €108 million contract, resting on a cracked column of PHP, OpenSSL, curl, FFmpeg, libxml2, core-js and pgBackRest, held up by volunteers, beside a jar of $730,534 from 536 donors and a sign saying 11 part-time engineers on duty, while an official with binoculars holds a €2 billion, seven-year sovereignty package. Reused from Dion's public post, with credit. | wide
> What came next. Who maintains the PHP you run? takes the business models further: what the PHP Foundation sells today, who sold the fix for old PHP, the OpenJS model that shares revenue with the projects, and seven services that should exist now.
9 unchanged paragraphs, under In short {#in-short}, The piece {#piece}
Dion Wiggins published a post and a long-form article on 23 October that I think everyone working on digital sovereignty should read. HisThe metric is simple: divide what a government spends migrating onto open source by what it contributes to maintaining that open source. For Germany and PHP hethat getsgives €27 million a year against €112,000 a year: 241 to 1. HisDion's line for it: "Any government whose ratio exceeds 10:1 does not have a sovereignty strategy. It has a procurement preference with no supply chain behind it."
HeDion then walks the rest of the stack: LibreOffice, Nextcloud, FFmpeg, curl, OpenSSL, Kubernetes Ingress-NGINX, pgBackRest, libxml2, core-js, each with a funding gap, a staffing gap, or both. And heDion points at a post the PHP Foundation published seven weeks before php2shell, "Digital Sovereignty Is Written in PHP", whose author, Sebastian Bergmann, named the problem in advance: "the institutions most dependent on PHP have no established mechanism" to turn that dependency into maintenance funding.
6 unchanged paragraphs, under The numbers, checked {#checked}
• The ratio. 241 to 1 on hisDion's figures, 263 to 1 on the agency's page, 179 to 1 on the migration share alone. Two orders of magnitude, however you cut it.
1 unchanged paragraph
• The shutdowns. The PHP story's impact ledger records them on 21 October, as Dion says. Two details are narrower than histhat summary: Finland's Valtori restricted incoming public traffic from 12:45 local time, as a precaution, with internal networks unaffected; and the UK figure is a minister saying that 32 central government services were unavailable and four partially, at one moment, which the site's fact-check desk keeps as an open question.
5 unchanged paragraphs, under Two days on, from our evidence {#two-days}
Dion writes that "every government in every country waited for the same patch from the same" small team. The patch itself came fast: PHP's four fixed releases were all out by 21 October. What followed is the part hisDion's article calls the packaging and distribution layer, and our data shows how slow that layer is.
18 unchanged paragraphs, under An assessment in a day {#assessment}, Why this is a business model failure {#model}, What would work {#work}…
• Some of Dion's figures I have not checked. Listed above; they are his,Dion's, with hisDion's sources.
2 unchanged paragraphs
• The proposals are mine. Not Dion's, though hisDion's article points the same way.
1 unchanged paragraph, under Where this comes from {#sources}
Dion Wiggins' post and article of 23 October 2026, and histhe illustration, reused from hisDion's public post with credit; Sebastian Bergmann's "Digital Sovereignty Is Written in PHP"; the PHP Foundation's report for 2025; the Sovereign Tech Agency's page for PHP; Materna's press release of 22 May 2025; the NCSC-NL inventory at 2fdc314, parsed with the PHP story site's own tool; CISA's catalogue feed, read at 14:41 UTC on 23 October; and the PHP story's site at v0.10.3. Related: the eyeballs get cheap, the code you do not ship, free to copy, paid at the source, application behaviour policies, PHP October 2026, at 8pm. Written up and checked by this site's agent, newsroom.writer; the editorial responsibility is mine.