Yesterday, the tech world held its collective breath. Two critical, pre-authentication remote code execution vulnerabilities, dubbed “PHP2Shell” (CVE-2026-109618 and CVE-2026-109619) were disclosed and patched across core PHP engine versions.
For digital agencies, it was a fire drill of epic proportions. Client phones rang non-stop as teams scrambled to patch, test, and isolate production environments. For website owners, it triggered an urgent question: “How safe is our digital presence until the patch is applied?”
Because when PHP is vulnerable, the internet itself feels the tremor. PHP powers almost 70% of the web. It’s the engine beneath target-rich e-commerce giants running WooCommerce or Magento, critical government information portals, healthcare booking portals, non-profit donation systems, and major institutions like Wikipedia and the Internet Archive. A flaw in core PHP isn’t just a code bug, it is an infrastructure crisis.
Dropping everything
While agencies ordered pizza’s, another story played out behind the scenes. The fixes didn’t magically appear from a multibillion-dollar corporate headquarters. They came from open-source maintainers and volunteers.
When critical zero-days strike, these unpaid or modestly funded maintainers are forced to put down their paid work, step away from their families, and drop day-job client commitments to log 18-hour days. They operate under immense pressure, analyzing complex memory-corruption vector chains, coordinating secret security disclosures across worldwide hosting ecosystems, writing patches, and verifying builds. All so the rest of the web can safely do business. They are the emergency first responders of the digital age, yet they rarely get a hero’s welcome.
The ecosystem illusion: Open Source Software as a community garden
We have treated open-source software like a natural resource: infinite, self-replenishing, and free. But open source is not a natural resource. Open source is a community garden.
If everyone comes to pick the apples, harvest the tomatoes, and take photos of the flowers, but nobody stays to weed, enrich the soil, or water the plants, the garden will eventually die.
For decades, enterprises have harvested millions (if not billions) in revenue built on top of free frameworks, core runtimes, and open-source packages. Yet, when the garden faces a crisis, or catches fire, we look around and wonder why there aren’t more full-time gardeners on duty.
Expecting unpaid volunteers to secure the core runtime of 70% of the internet is a risk model that is no longer sustainable.
A call to action for business leaders: Time to pay the water bill
In my opinion (and I know I’m not alone in this), every enterprise, agency, and business owner needs to take two immediate steps:
- Audit your Open Source Bill of Materials (SBOM): Identify every open-source package, core language runtime, framework, and plugin that keeps your digital doors open and drives your revenue.
- Fund your supply chain: Allocate a dedicated percentage of your annual software engineering budget directly to open-source sustainability. Sponsor maintainers on platforms like GitHub Sponsors, Open Collective, or the PHP Foundation.
Sponsoring open source isn’t charity, it’s risk management and critical supply-chain security. If your business depends on the garden, it is time to help pay for the water.
How is your organization supporting the maintainers who keep your tech stack safe? I’m curious to hear your experiences. Not just for myself, but also to share with the world to show how we can do better.
Photo by Elaine Casap
Leave a Reply