Home / Articles / Who maintains the PHP you run? A follow-up to the maintenance deficit / Versions / v1.1.0
Who maintains the PHP you run? A follow-up to the maintenance deficit: what changed in v1.1.0
From v1.0.0 (2026-10-23, 02627ff76) to v1.1.0 (2026-10-23, e50452d9f), paragraph by paragraph.
3 paragraphs added, 2 removed, 1 changed in place, 45 unchanged. About 366 words added and 278 removed. Insertions are marked like this, deletions like this; unchanged runs are folded to one line; figures appear as their file names.
Who maintains the PHP you run? A market failing both ways, the services and business models that should exist now, and why the money has to reach the people who know the code
Summary: php2shell asks every organisation that switched a website off one of two questions. Either the site does not matter, and it can stay off. Or it matters, there is a real cost to it being down, and somebody has to pay to keep it maintained. Today almost nobody is paying, and that is not because the money is missing; it is because the market is failing both ways. The organisations that run PHP have no maintenance of exactly what they run to buy. The people who know PHP best, its core developers and the people around its foundation, have no product to sell them: the foundation sells sponsorship tiers, and its packager for Debian and Ubuntu does it "mostly in my free time". When the flaws landed, the PHP security team wrote the fixes and published source backports for old versions for free, and vendors sold builds of those fixes within a day, with no stated share flowing back. One model shows it can be different: since 2024 the OpenJS Foundation has endorsed a vendor that shares 15% of its revenue with the projects it supports. So here are the services I think should exist now, starting with bringing the switched-off sites back, and the rules that would make the money flow to the people who maintain the code. This is not about leaving open source; it is about fixing its economics, for PHP first, then Node, Python and the rest.
Who maintains the PHP you run? A follow-up to the maintenance deficit: a market failing both ways, the services and business models that should exist now, and why the money has to reach the people who know the code
Summary: A follow-up to the maintenance deficit, with evidence, which followed the money spent on top of PHP; this one follows what should be bought instead. php2shell asks every organisation that switched a website off one of two questions. Either the site does not matter, and it can stay off. Or it matters, there is a real cost to it being down, and somebody has to pay to keep it maintained. Today almost nobody is paying, and that is not because the money is missing; it is because the market is failing both ways. The organisations that run PHP have no maintenance of exactly what they run to buy. The people who know PHP best, its core developers and the people around its foundation, have no product to sell them: the foundation sells sponsorship tiers, and its packager for Debian and Ubuntu does it "mostly in my free time". When the flaws landed, the PHP security team wrote the fixes and published source backports for old versions for free, and vendors sold builds of those fixes within a day, with no stated share flowing back. One model shows it can be different: since 2024 the OpenJS Foundation has endorsed a vendor that shares 15% of its revenue with the projects it supports. So here are the services I think should exist now, starting with bringing the switched-off sites back, and the rules that would make the money flow to the people who maintain the code. This is not about leaving open source; it is about fixing its economics, for PHP first, then Node, Python and the rest.
> A follow-up to the maintenance deficit, with evidence. That article followed Dion Wiggins' numbers on what governments spend on top of PHP against what reaches PHP itself. This one takes the next step: what each organisation running PHP should be buying, the services that should exist now, and how the money reaches the people who know the code.
10 unchanged paragraphs, under In short {#in-short}, Two questions {#two-questions}
When the flaws in PHP landed on 21 October, organisations across Europe and beyond switched websites off as a precaution: government login services, councils, universities, wikis. In thethe maintenancearticle deficit,this withone evidencefollows, I followed Dion Wiggins' numbers on what governments spend on top of PHP against what they spend on PHP itself. Here I want to follow the other thread: what each of those organisations should be buying.
35 unchanged paragraphs, under A market failing both ways {#both-ways}, What happened to the old versions {#old-versions}, It can work: the OpenJS model {#openjs}…