PHP Foundation: 69% of the web, $645K a year, and Laravel just left

Short answer: The PHP Foundation is the group that pays the people who keep PHP alive, and it is broke by any sane standard. It took in $645,191 in 2025 and spent $784,376, while PHP sits under 69.2% of websites and Packagist served 35.95 billion installs. Reuters' headline this week says it runs with one full-time staff member. Our read: the web's most used server language is being run as a charity by the companies that profit from it most, and the biggest name in modern PHP just walked off the sponsor list.

TL;DR: PHP's foundation spent $139,185 more than it received in 2025, and today's balance of about $469K covers 7.2 months of last year's spending. We pulled every Packagist install since 2012 and the foundation got $17.95 per million installs in 2025. Laravel raised a $57M Series A in 2024, sat at the $24K Gold tier through Sep 7 2026, and by Oct 8 2026 the foundation's own site lists it as a Past Sponsor, right as PHP's security team was working weekends on two remote code execution bugs. If your business runs on PHP, you are the free rider in this story, and the bill for that showed up on Oct 21.

Key numbers

What	Number	Source, checked Oct 25 2026
Websites with a known server-side language that use PHP	69.2%	W3Techs
All websites running WordPress (PHP)	39.6%	W3Techs
Packagist installs, all time	207,999,092,524	Packagist
Packagist installs in 2025	35.95 billion	Packagist monthly series, our sum
Foundation money received in 2025, after fees	$645,191	PHP Foundation 2025 report
Foundation spending in 2025	$784,376	PHP Foundation 2025 report
Money received per million installs, 2025	$17.95	Our math from the two rows above
Balance today, USD + EUR collectives	$356,483 + EUR 99,891 (about $469K)	Open Collective API, FX from FRED
Contracted developers on Jan 1 2026	11	PHP Foundation 2025 report
Laravel Series A	$57M (Accel, Sep 5 2024)	Laravel News
Gold sponsor tier	$24,000 a year	thephp.foundation/sponsor
Laravel's listing on the foundation site	Gold on Sep 7 2026, Past Sponsor by Oct 8 2026	Wayback Machine, live site

The language under most of the web runs on less than a startup's seed round

Reuters ran it on Oct 23: "PHP Foundation 'under-funded' with one full-time staff member, director says." The Hacker News thread hit 130 points and 86 comments, most of them arguing about whether PHP even matters anymore.

It matters. W3Techs counts PHP on 69.2% of every website whose server language it can detect. JavaScript, the runner-up, is at 8.2%. WordPress alone is 39.6% of all websites, and WordPress is PHP.

The foundation's own 2025 report says it ran on 8 volunteer board members, one executive director whose salary JetBrains sponsors, and 11 contracted developers working "part- and full-time." Those 11 people wrote roughly 42% of all commits to PHP's core in 2025. That is the whole professional bench for the language most of the internet runs on.

When the foundation launched in Nov 2021, JetBrains called PHP "the language that powers 78% of the Web" and named the problem out loud: the bus factor. Core developer Nikita Popov was leaving for LLVM, and one person's exit could break the language. Five years later the bench is bigger, but the money is still tiny.

The money: spending passed income in 2024, and the gap is growing

The foundation publishes its books, which is more than most big companies do for the open source they lean on. Here is the whole run since launch, straight from its report:

Year	Donated	Received after fees	Spent	Gap
2021-2022	$712,484	$622,211	$133,285	+$488,926
2023	$478,767	$418,669	$275,181	+$143,488
2024	$683,550	$600,440	$635,487	-$35,047
2025	$730,534	$645,191	$784,376	-$139,185

Fees eat about 12% before a cent reaches a developer: a 10% fiscal host cut to Open Source Collective plus 1-5% for payment processing. The report calls the 2025 deficit "a deliberate choice to maintain investment in technical headcount." Translation: they spent the savings to keep the engineers, and they are betting sponsors show up before the savings run out.

We pulled the live balances from Open Collective this morning: $356,483 in the USD collective and EUR 99,891 in the euro one, about $469K combined. At 2025's burn of $65,365 a month, that is 7.2 months of runway if donations stopped tomorrow. They will not stop, but that is how thin the cushion is under the web's default language.

208 billion installs, $17.95 per million

Packagist is PHP's package registry, the place Composer pulls libraries from. It publishes its install counts, so we summed every month since 2012. All time: 207,999,092,524 installs. In 2025 alone: 35.95 billion. In 2026 so far, through today: 42.72 billion, already past all of last year.

In the last 29 full days it served 6.65 billion installs. The busiest single day, Oct 21, the day the RCE patches shipped, hit 330.9 million. Usage is not the problem. PHP is lowkey the most installed thing nobody pays for.

Divide the money by the downloads and you get the number that should embarrass the whole industry: $17.95 per million installs in 2025. That is under two cents per thousand. For scale, a Platinum sponsorship is $100,000 a year, and only four organizations hold one: JetBrains, Automattic, the German government's Sovereign Tech Agency and the security fund Alpha-Omega. Two of those four are public money and security grants, not companies that sell PHP products.

Laravel raised $57M. Today it is a "Past Sponsor"

Laravel is the most loved framework in modern PHP and the one founding member with venture money. Taylor Otwell (@taylorotwell) announced on Sep 5 2024 that "Laravel has raised a $57M Series A in partnership with Accel." Laravel was one of the ten founding members of the PHP Foundation.

We pulled 25 readable archived copies of the foundation's homepage from the Wayback Machine, Aug 2024 to Oct 23 2026, to track where Laravel sat on the sponsor list. Here is the receipt:

Snapshot	Laravel on thephp.foundation
Aug 2 and Sep 1 2024	Past Sponsors
Sep 5 2024	Laravel announces its $57M Series A
Oct 1 and Nov 6 2024	Still Past Sponsors
Dec 2 2024 through Sep 7 2026	Gold ($24,000 a year tier)
Oct 8, Oct 14 and Oct 23 2026	Past Sponsors
Oct 25 2026 (live site)	Past Sponsors, first name on the list

The Gold tier is 0.042% of that Series A, per year. And the foundation's rules say sponsors are only removed at the end of a calendar year if they miss the threshold, so a mid-year move to Past Sponsors is not a quiet expiry date. Something changed between Sep 7 and Oct 8.

We do not know what. Maybe a payment lapsed, maybe a contract is being renegotiated, maybe Laravel is funding PHP work some other way, like its own team's contributions. To be fair, Laravel has done this dance before: it was a past sponsor in the summer of 2024, raised the $57M in September, and was back at Gold by December. But look at the timing this time: the foundation says the whole security team had been on two critical RCE bugs since Aug 11, "eventually through weekends and around the clock." The framework that raised the most money in PHP history was off the paying list during PHP's worst security month in years. That is not a great look, fr.

@taylorotwell, if Laravel is back at Gold or better, post the receipt and we will update this page the same day.

Worst offenders: who rides PHP and what they pay

Laravel is not the only one. Here is the ranking we would put on a billboard, every number pulled this week:

• Wikimedia Foundation. Revenue of $180.2M in its fiscal year to June 2023, per its IRS 990. MediaWiki, the software under Wikipedia, is written in PHP. Wikimedia is not on the foundation's sponsor tiers or its past-sponsor list. Small donations are possible, but at Silver ($12,000) and up, it is not there.
• GoDaddy. $5.10B of revenue in the four quarters to June 2026, per its SEC filings. It sits in Gold, the tier that starts at $24,000. Credit where due, it pays. But a hosting giant whose shared plans run on PHP sites gives the equivalent of 0.0005% of a year's revenue at the tier floor.
• Founding members who left. Of the ten companies that founded the PHP Foundation in 2021, three are now listed as Past Sponsors: Laravel, Acquia (the Drupal company) and PrestaShop. Shopware, another big PHP commerce platform, is a past sponsor too.
• Chainguard. Not a money story, a trust one. The foundation says Chainguard "unilaterally broke the embargo" on Oct 21, shipping patched images more than six hours before the coordinated release, so attackers could diff the fix while everyone else waited. Chainguard is not on the sponsor list either.

The bug that waited two years because nobody was paid to finish it

This is where the funding story stops being abstract. On Oct 21 PHP shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical unauthenticated remote code execution bugs, CVE-2026-109618 and CVE-2026-109619. We covered the fallout in our survey of 235 top sites that can never get the fix.

The foundation's own post-mortem is brutal. A foundation-paid contractor found "the first signs of the OOM problem" in 2024. The fix "stall[ed] and restart[ed] repeatedly over months" because "the small team of core developers with the necessary deep knowledge of the engine" was "occupied with many responsibilities." Their words: "the delay was a structural failure, caused by both the security team's decision process and its lack of resources."

Then the AI wave hit. The foundation used Anthropic's Claude Mythos (via Alpha-Omega) and OpenAI's Daybreak Red. Calif, OpenAI and Wiz all reported paths to remote code execution in August and September. Since Jul 1 the team has published 15 CVEs and waded through more than 100 reports that turned out to be invalid, duplicates or not reproducible. AI labs can now find bugs in PHP at industrial scale. Humans still have to fix every single one, and the humans are 11 contractors.

Our bet: this is the pattern for every old, load-bearing language from here on. AI makes finding bugs nearly free and leaves fixing them exactly as expensive as before. Whoever pays the fixers controls how safe the web is. Right now that is mostly JetBrains, Automattic and two security grants.

Python gets $3.79M per point of web share. PHP gets $6,919

We pulled the latest IRS 990 filings for the other language foundations from ProPublica and lined them up against W3Techs web share. It is not a perfect comparison, and we will say why in a second, but the gap is too big to explain away.

Organization	Revenue (tax year 2023)	Language share of websites	Revenue per point of share
Python Software Foundation	$4,173,023	1.1%	$3,793,657
Apache Software Foundation	$2,313,188	n/a	n/a
Ruby Central	$2,128,731	7.1%	$299,821
Django Software Foundation	$316,832	n/a (Python framework)	n/a
PHP Foundation (2023 donations)	$478,767	69.2%	$6,919
WordPress Foundation	$26,438	39.6% of all sites run WordPress	n/a

The fair caveats: PSF revenue includes PyCon tickets and grants, and Python's real footprint is data science and AI, not websites. Ruby Central runs RubyGems and RubyConf. Web share is one lens, not the whole picture.

Still, look at the floor. Django, one Python web framework, took in $316,832 in 2023. The PHP Foundation took in $478,767. The language under 69% of the web out-raised a single framework of a 1.1% language by $161,935. That is the bar it is clearing.

Follow the money: who wins and who loses

Winners: every company that sells something built on PHP and pays nothing for the engine. Hosting companies, e-commerce platforms, agencies, SaaS on Laravel, and anyone shipping a WordPress plugin. Their cost of PHP is zero and their risk is somebody else's weekend.

Also winning: the AI labs. Scanning PHP with frontier models is great PR and great training data. The patching labor lands on the foundation.

Losers: the 11 contractors carrying the language, and every small site owner who got an unauthenticated RCE notice on Oct 21. Also European taxpayers, kind of: the Sovereign Tech Agency, a German government fund, is a Platinum sponsor, so public money is covering for private companies that will not pay.

The HN thread had a sharp take from user grokys: "I'm increasingly coming around to the idea that OSS was the biggest swindle the corporations managed to pull off." We would not go that far. We would say the market for open source is broken in one specific way: usage is measured to the install, and payment is optional.

What we think happens next

• A big AI or cloud company buys PHP's security with one check. The pattern says the company that scans a codebase with its model ends up funding the fixes, because the reports come back on its brand. Our bet is a new Platinum name within 12 months, and it is an AI lab.
• The 2026 deficit is bigger than 2025's. The foundation added a security triage hire in July and a hardening hire in September. Unless sponsors jump, expenses beat $784K and the gap beats $139K.
• Laravel comes back, loudly. A $57M company does not want "Past Sponsor" next to its name in the week Reuters calls PHP underfunded. We expect a Gold or Platinum line before the end of the year.

Nobody has proven any of these yet. That is why they are bets. The numbers they sit on are in the CSV below.

What this means for you

If you run PHP, patch first: 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or newer. If your server is on an end-of-life branch like 7.4, there is no fix coming, and you need to plan the upgrade this week.

If your company makes money on PHP, Silver sponsorship is $1,000 a month. That is less than one contractor-day at most agencies. You get your logo on the site and a seat on the advisory board, and the language you depend on gets one more person fixing it. Read the numbers yourself in the foundation's 2025 report.

And if you built a PHP or AI-built app and want to know whether it is safe to launch before strangers find the holes, that is what our $49 Launch Check does. If anything we promise does not do what it says, we keep fixing it at no extra cost until it does.

More from us: today's news, deep tech and money, Node2Shell: a Brotli fix that sat in public for 236 days and Wikipedia's human readers are leaving. This is not financial advice; it is a look at public books.

Sources

• The PHP Foundation, Impact and Transparency Report 2025, May 27 2026, read Oct 25 2026
• The PHP Foundation, Today's PHP Security Release, and How We're Strengthening PHP Security, Oct 21 2026
• The PHP Foundation homepage, sponsor and past-sponsor lists, live Oct 25 2026
• The PHP Foundation, sponsor tiers, Oct 25 2026
• Wayback Machine snapshot, Sep 7 2026 and Oct 8 2026, plus 23 more readable copies from Aug 2024 to Oct 23 2026
• Open Collective, PHP Foundation and PHP Foundation EUR balances via the public GraphQL API, Oct 25 2026
• Packagist statistics and laravel/framework stats, Oct 25 2026
• W3Techs, server-side languages and WordPress, Oct 25 2026
• ProPublica Nonprofit Explorer: IRS 990s for the Python Software Foundation, Ruby Central, Apache, Django, WordPress Foundation and Wikimedia Foundation, Oct 25 2026
• SEC EDGAR, GoDaddy XBRL revenue, 4 quarters to Q2 2026
• Laravel News, Laravel raises a $57 million Series A from Accel, Sep 5 2024
• JetBrains, The New Life of PHP: The PHP Foundation, Nov 22 2021
• Reuters, PHP Foundation 'under-funded' with one full-time staff member, director says, Oct 23 2026
• FRED, USD/EUR exchange rate (DEXUSEU), 1.1231 on Oct 16 2026