In March, the Linux Foundation announced a grant with the goal of strengthening the security of the open source software ecosystem. This funding is managed by Alpha-Omega and the Open Source Security Foundation (OpenSSF).

We're delighted to announce the PHP Foundation has been awarded a grant from Alpha-Omega to help improve the security of the PHP open source ecosystem.

PHP is foundational to the modern web, and ensuring its security is essential for a significant portion of the web's functionality and integrity.

New security tools making use of AI are accelerating the discovery of vulnerabilities in open source software. Initiatives like Project Glasswing are attempting to prepare software for the increasing accessibility of such tooling to bad actors. A number of large PHP projects have already received and acted on credible audit reports and concrete issues found by these new tools.

At the same time, many projects have been reporting a drastic increase in the volume of vulnerability reports they have to deal with, many bearing the hallmarks of lazy AI generation. These low-quality reports waste maintainers' time and overshadow legitimate issues.

The PHP Foundation is creating a PHP Ecosystem Security Team to help our ecosystem maintainers with these new challenges. This new PHP Foundation team will help triage vulnerability reports and disclose them responsibly as necessary. It will work on tooling to discover, classify and remediate security vulnerabilities and share emerging techniques on using them effectively and help the PHP ecosystem adopt these tools. The team will respect maintainer bandwidth, provide high-quality reports, coordinate project access to new security tooling, support projects with only a few maintainers, and find solutions for projects with no active maintainers at all.

We're excited our friends at the Drupal Association were awarded a similar grant from Alpha-Omega to secure the Drupal ecosystem built on top of PHP. The PHP Foundation is looking forward to collaborating with the Drupal Security Team on shared approaches and we hope to be joined by more experts from individual PHP projects and subcommunities as we build out the new team.

The PHP Foundation grant will fund a six-month full-time position titled "Ecosystem AI Security Engineer in Residence at the PHP Foundation" to lead this effort and to prepare a sustainability plan for the time after this initial phase. This person will act as a trusted intermediary between security researchers and maintainers in urgent, high-risk situations, and will collaborate with peers in similar roles across other language ecosystems. Additionally, grant funding will also be employed toward the team goals described above where they cannot be accomplished by the single paid lead position or with the help of PHP community volunteers.

After many conversations with community leaders in the PHP ecosystem, known security experts and Foundation stakeholders, the PHP Foundation board voted unanimously to offer the position to Volker Dusch (@edorian). We asked Volker to introduce himself.

Meet Volker

👋,

Some of you may know me as one of the PHP 8.5 Release Managers, or might have met me at one of more than 100 PHP-related conferences I've visited or spoken at in the last 20 years.

PHP has been the main programming language of my professional career, from helping maintain PHPUnit for a couple of years and more recently, working on various language RFCs.

In the past, I've worked on a high-traffic social networking site, remote monitoring of solar plants and software for medical trials. Currently, I'm working on PHP performance and monitoring tooling at Tideways, which I'm grateful to for allowing me to take some time off to focus on this new challenge.

Interested in hearing from me? Got feedback?

My goal is to be open and communicate early about how the Ecosystem Security Team is taking shape while making the most of the resources we have.

Big projects and foundational libraries are on my radar for security analysis already, and I'm especially keen to hear from people who want to actively collaborate and have the bandwidth to do so.

So if you want to put your project forward or have questions or comments for me, I'd love to hear from you!

Get in touch via email: volker@thephp.foundation.

You can also find me on Mastodon and LinkedIn.

Our goal is to capture perspectives from across the PHP community – we want as many voices as possible to be included. To make that happen, we’re starting by collecting suggestions for survey questions.

This week, you can submit your proposed questions and upvote others through a dedicated form. We’ll review all submissions and select the most interesting ones to include in the survey, which will launch in June. If you have an idea for a question, you can submit your question here.

The submissions are open until April 28, 2026. We look forward to hearing from you!

Part 1: Feedback from the Community

Oh my friends, we have so much to talk about.

I’ve been with The PHP Foundation for a few weeks, and many people have asked me about my vision, goals, and strategy for the upcoming year. In my opinion, The PHP Foundation’s stated mission of ensuring the long-term prosperity of the PHP language can be interpreted many different ways. So what exactly does this mean in terms of actionable efforts that will impact the community in the ways that align with this mission?

To answer that question, my goal was simple: listen to people who have a vested interest in the success of PHP and see what themes emerge. So I opened my calendar, messages, and email, and you all answered the call.

So far, I have connected with around 60 people from 18 countries. I’ve heard from PHP community members, people working in the ecosystem, maintainers of PHP projects, consultants, sponsors, core developers, leaders of other open source foundations, user group organizers, and of course, our own Foundation staff and Board members. I am thrilled that you all had a lot to say, because as I’ve said before, apathy is a much harder problem to tackle.

Before I share the findings, It is important to note a few things:

• Even though people identified many issues that could be better, there is still much love for PHP and the community.
• Some of the issues brought to me are not within the scope of The PHP Foundation’s authority. That being said, there are places where we can offer our support.
• These findings represent the concerns that were brought to me, and they aren’t presented as “fact” or official opinions of The PHP Foundation.
• Some of the findings may be of no surprise to you. And some of them may not resonate with you personally. I’d just ask that you keep in mind that the feedback is honestly presented as it was shared, and that these are also valid experiences from others.

High Level Summary of Findings

Overall, these were the biggest takeaways:

• PHP’s biggest challenges are perception, coordination, and onboarding, not technical capability
• The community loves the language and would choose PHP over other options, despite the challenges
• The ecosystem is large but fragmented
• The newcomer experience, education, and talent pipeline have room for improvement
• The PHP Foundation’s role and impact is not well understood
• Funding is a shared challenge across open source
• AI brings much uncertainty and many polarizing opinions, so agreeing upon a unified approach will be very challenging

I've classified the feedback I received into four primary buckets:

I created this slide presentation to share and summarize the feedback I received. You can also view it on GitHub as a PDF or in Markdown. I encourage you to take a look.

What’s Next?

In a follow up blog post (Part 2), I will be sharing The PHP Foundation’s strategies that aim to address some of these issues. And as always, please don’t hesitate to reach out if you have input or feedback to share. You can reach me via email or you can schedule some 1:1 time with me on my calendar.

Please join us in welcoming Matt to the Foundation Board!

A little about me

PHP was my introduction to open source, when PHP 3 was the latest release. It was mind blowing to see an amazing group of smart, funny people collaborate with each other, help newbies, and build impactful things together while still having fun. People who lived thousands of miles away from each other and who had never met each other. People who had completely different backgrounds and daily lives. People who spoke different languages and lived in different time zones. They all managed to find a way to come together as a community. They wrote code, they organized events, they started local user groups, they built projects together, and they helped each other learn. Forgive my sentimentality, but it was (and still is) magical.

It was this sense of community that fascinated me most, and I found myself moving from PHP development to open source community management. Since officially making that switch in 2010, I’ve worked for companies like GitHub, Sourceforge, and Pivotal, striving to make open source healthier, more inclusive, and better for everyone. I wanted anyone with an interest to be able to join the open source party, bring their unique set of skills, and experience the magic firsthand.

For the last 6 years, I have worked as the Community Manager for an open source project called CHAOSS which focuses on open source community health and sustainability. It has been an unforgettable experience, I’m very proud of what we all accomplished together, and I love that community very much. But as I find my career pivoting back toward PHP, it honestly feels like coming home again.

Looking to the future

The progress that has been made by the Foundation in the last few years is remarkable! Moving forward, you can expect to see the same kind of commitment to improving the PHP language and to keeping PHP relevant and sustainable.

In addition, we aim to increase the Foundation’s transparency and openness, and to strengthen our collaborative relationships with users, sponsors, contributors, organizations, and the PHP community at large. A solid and thriving PHP ecosystem belongs to and benefits us all, but none of us can make that happen alone.

Let’s chat!

Because we’re all in this together, I want to spend the next 1-2 months really listening to what you have to say. I have an open calendar and I encourage you to reserve some time with me. I want to hear from PHP developers, contributors, companies using PHP, independent consultants, sponsors, community members, and anyone else interested in the future of PHP. I want to hear about your goals, your motivations, your pain points, and yes, even your wacky and unorthodox ideas. And if meetings aren’t your thing, that’s completely understandable. You can also send me an email. (I’ll even check my inbox!)

PHP’s secret recipe has always been its community and I can’t wait to be collaborating with you all again!

Elizabeth brings a rare combination of deep roots in the PHP community and proven leadership in open-source governance. She co-founded a volunteer-based nonprofit dedicated to supporting women and non-binary individuals in the PHP industry, served as Community Manager at GitHub where she led developer outreach programs including the Patchwork initiative, and has been active in CHAOSS – a project focused on open-source community health metrics.

Her experience spanning community building, fundraising, outreach operations, and open-source strategy makes her a natural fit to lead the foundation into its next chapter.

As previously announced, founding Executive Director Roman Pronskiy is transitioning to focus on his growing role at JetBrains, while continuing to serve on the Board of Directors. Roman will work closely with Elizabeth to ensure a smooth handover.

Please join us in welcoming Elizabeth. We're looking forward to what's ahead. 🐘💜

team.blue is a leading AI-powered digital enabler serving small and medium businesses (SMBs) and agencies across Europe. With more than 4,000 experts, 3.3 million customers, and operations in over 22 countries, team.blue provides businesses with the digital tools they need to build, grow, and scale online. Its ecosystem spans domains, hosting, cloud solutions, website and e-commerce tools, and a fast-growing portfolio of AI-driven SaaS products. For team.blue, PHP represents a foundational technology across its platforms and services.

PHP: the engine behind team.blue's platforms

PHP's performance, stability, and extensive ecosystem also provide a scalable basis for delivering AI-powered capabilities and intelligent user journeys, enabling million SMBs to grow and succeed online. PHP underpins:

• Shared hosting and managed WordPress products at brands like Combell, Register.it, and TransIP.

• PHP-based SaaS products (core app logic, integrations, and day-to-day feature work).

• Internal tools and systems used across the group.

PHP's mature ecosystem and proven scalability allow team.blue to build sophisticated digital tools that help SMBs and agencies grow online, demonstrating how the language powers modern high-traffic platforms across diverse use cases.

Discover more about the team.blue ecosystem: https://team.blue/our-ecosystem/

Giving back to the PHP community

As a Gold Sponsor, team.blue is putting tangible support behind PHP, helping accelerate progress, maintain strong security, and back the ecosystem globally, while directly supporting the essential work of maintenance, continuous improvement, and ensuring the language remains ready for what comes next.

Learn more about team.blue and its mission to make online business success simpler: https://team.blue/

The gist

In PHP 8.6, it will be possible to create a closure that simply delegates to another function without writing out the whole closure.

// This
$underscore = str_replace(' ', '_', ?);

// Is effectively the same as this:
$underscore = fn(string $s): string => str_replace(' ' , '_', $s);

Both lines will produce nearly identical opcodes, but the former is much easier to both write and to read, as it doesn't require messing about with redeclaring all the types and variable names.

Any function (or method) call may use one of two placeholders, ? or ..., to indicate that it is only "partially invoking" that function. Or "partially applying arguments to it." It works with both positional and named arguments, too!

function complex(int $a, int $b, int $c, int $d): string { ... }

// This creates a closure that takes 2 ints and returns a string.
$f = complex(?, 2, ?, 4);

// This creates the same closure, but with named arguments.
$f = complex(b: 2, d: 4, ...);

// This reverses the order of the parameters, $f needs $c first, then $a.
$f = complex(b: 2, d: 4, c: ?, a: ?);

// Keep all arguments unbound. Hey look, first-class-callables!
$f = complex(...);

// This creates a zero argument closure, which just calls complex() when invoked!
$f = complex(1, 2, 3, 4, ...);

PFA supports a wide variety of complex use cases and features, like parameter reordering, named arguments, variadics, etc. In practice, however, we expect most uses to be reducing a function down to a single remaining argument (that is, currying). That makes it perfect to use as a callback. Most of PHP's functions that take callbacks expect a single argument, and the few remaining take two (such as a value and a key). PFA makes using arbitrarily complex, contextually aware functions in those cases trivially easy.

// This
$result = array_map(in_array(?, $legal, strict: true), $input);

// is much nicer than this
$result = array_map(fn(string $s): bool => in_array($s, $legal, strict: true), $input);

By design, it's also the perfect complement for the new pipe operator. To reuse some examples from the Pipe RFC:

$numberOfAdmins = getUsers()
    |> array_filter(?, isAdmin(...))
    |> count(...);

$result = "Hello World"
    |> htmlentities(...)
    |> str_split(...)
    |> array_map(strtoupper(...), ?)
    |> array_filter(?, fn($v) => $v != 'O')
;

What's more, optimizations around the pipe operator mean the closure doesn't even need to be created in those cases, so there's zero performance overhead.

The RFC has more details on all the ins and outs of the new syntax.

The long view

If all of this sounds a lot like an extended version of "first class callables," it should. Or rather, "first class callables," are the training wheels version of partial function application.

PFA was first proposed way back in 2021, by a team of Joe Watkins, Levi Morrison, Paul Crovella, and myself. That version was largely similar on the surface, but had a different implementation that caused some consternation. In particular, Nikita Popov (at the time still PHP's de facto lead developer) felt that it introduced too much complexity in the engine. His hesitancy convinced many others to reject it at the time, though there was still a lot of interest and support.

There was enough support, however, that Nikita asked "couldn't we just do foo(...) to delay all the variables, and skip the rest of the RFC?" The result of that was the First Class Callables RFC, released in PHP 8.1.

I've been looking to take a second swing at PFA since then, but needed the right time and right collaborators. FCC has clearly shown itself to be a huge boon to the language, so why not go all the way? It wasn't until the Pipes RFC passed earlier this year, though, that I was able to snare the PHP Foundation's Arnaud Le Blanc into working on a second version with me. It didn't quite make it into PHP 8.5 for timing reasons, but it's now available in 8.6.

So what changed? One, FCC ended up already including a lot of the underlying engine trickery that was needed for this version of PFA. We were able to leverage that. For another, the implementation is a bit different. Rather than creating a special kind of pseudo-closure that can be extra-optimized, the new approach just creates a normal closure object like we've had for years. That makes it much simpler to implement and solve a ton of edge-case questions. Three, now we have pipes.

And oh boy is this an exciting combination.

A long time coming

PFA for PHP really began even before 2021. As discussed in the Pipes blog post from July, way back in 2016 Sara Golemon proposed porting Hack/HHVM's pipe syntax to PHP:

$result = $arr
    |> array_column($$, 'tags')
    |> array_merge(...$$)
    |> array_unique($$)
    |> array_values($$)
;

That was never approved, but led us to try splitting the syntax in two: The pipe operator itself, and partial function application instead of $$. We tried in 2021 to get both, but both failed. Now we have both.

One of the chief criticisms I've seen about the new pipe operator is the need to wrap up multi-parameter functions into an inline arrow function, and then wrap that in () to keep the parser happy. Which is a fair criticism! And the perfect fix for that criticism is... partial function application. Which we now have. The twins have been reunited.

PHP breaks the mold

I've often seen PHP criticized for just stealing features from other languages and piling them in willy-nilly. Frankly that's not always a bad thing: PHP, much like English, evolves by finding good ideas in other languages and ahem borrowing them, and making it our own.

Partial function application is not a new concept. It's been the foundation of many functional languages for decades. Haskell, for instance, implicitly uses partial application for literally every function call. Any function call can just omit its right-most arguments and poof, it becomes a partial application.

What I have not seen in any language, however, is the ability to partially apply arbitrary parameters. That's important for PHP, because while Haskell's entire standard library was built around the assumption of right-most partial application, PHP's most definitely was not. We needed to be able to turn arbitrary functions into unary (single-argument) functions to allow most parts of the standard library to work with... pipes. Or as callbacks.

And now we can. I do not know of any other language that has as flexible, powerful, and compact a partial function application syntax as PHP 8.6 will have. Here, PHP would seem to be the innovator.

Rock on, ElePHPants!

What comes next?

There's one more major piece of the puzzle still to come: Function composition. Where pipe executes immediately, function composition creates a new function by sticking two functions end-to-end. Sara Golemon helpfully got it started, but it still needs some work before it can be formally proposed.

That would complete the trifecta of "Functional Features" we've been trying to get into PHP for years to allow a much more natural use of functional techniques.

Each of these RFCs is, on its own, useful but not earth-shattering. Taken together... "synergy" may be a dirty word outside of management consulting, but in this case it applies. We are very close to blowing open PHP's functional capabilities in much the way that PHP 5.2 finally blew open its object-oriented capabilities. And as a multi-paradigm language, we'll be able to freely mix and match OOP and FP approaches where they make the most sense.

I can't wait!

Our Achievements This Year

Now in our fourth year, The PHP Foundation has achieved several milestones that have further strengthened the PHP ecosystem:

• Release of PHP 8.5
• PIE 1.0 Release
• Supporting FrankenPHP
• PHP MCP SDK together with Anthropic and Symfony
• 2nd Sovereign Tech Agency Investment for the Stream Layer Rework

Thank You to Our Sponsors

We owe a special thanks to our major sponsors who make our work possible:

Platinum

Automattic
Sovereign Tech Agency
JetBrains

Gold

Laravel
GoDaddy

Silver

Passbolt 🆕, Private Packagist, Craft CMS, Cybozu, Tideways. Zend by Perforce. Symfony Corp, Sentry. Manychat, Mercari Inc., Les-Tilleuls.coop, pixiv Inc., Aternos GmbH, CH Studio

In total more than 550 donations were made by businesses and individual sponsors to The PHP Foundation throughout this year through OpenCollective and more through our GitHub sponsors.

Your contributions enable us to support developers, fund crucial projects, and ensure PHP is a modern and reliable choice for web development.

If you are yet to decide on sponsoring the foundation, here you can find information on how to join us and why it matters or reach out directly to contact@thephp.foundation.

Outlook into 2026

Big changes are ahead for 2026, when our founding and long-term executive director Roman Pronskiy (JetBrains) will step down and the foundation will hire a dedicated executive director for the first time.

This marks a new chapter as we recognize that The PHP Foundation has grown so much that we consider a dedicated management position to be required to ensure that our projects and goals are getting done.

If you are interested in the Executive Director role, we are still looking for candidates to apply until December 15th, 2025.

Furthermore, we’d like to add 2 new developers to our team who applied to our program in autumn.

And mainly, our team will continue to maintain, document, and improve PHP further with the next major release (8.6 or 9.0) coming at the end of 2026.

Thank you,
The PHP Foundation
🐘💜

After four years at the helm of the PHP Foundation, Roman Pronskiy will conclude his tenure as Executive Director in early 2026. Roman founded and helped build the Foundation from the ground up into a stable, well-run organization, expanded our team of core developers, and deepened collaboration across the PHP ecosystem. As his role at JetBrains grows, Roman has decided to focus his efforts there while continuing to support the PHP Foundation’s next chapter.

We’re immensely grateful for Roman’s vision and leadership, which shaped the foundation’s first years and set a strong course for the future. He will continue serving on the Board of Directors as JetBrains’ representative, providing continuity as JetBrains remains a platinum sponsor and steadfast supporter of PHP. Roman will work closely with the incoming Executive Director to make the transition smooth and complete.

The Board has formed a search committee consisting of two board members Sebastian Bergmann and Nils Adermann as well as two community representatives Lorna Jane Mitchell and Ben Ramsey. The search committee will manage the selection process and find a leader who can build on the Foundation's momentum and guide us through our next phase of growth.

What we're looking for:

• Strong leadership experience in open source communities
• Deep knowledge of the PHP ecosystem
• Excellent project management and communication skills
• Strategic thinking and a vision for the foundation's future
• Experience working with diverse stakeholders and sponsors

This is an opportunity to shape the future of one of the world's most widely-used programming languages and support the vibrant community that sustains it.

How you can help:

We need the PHP community's help in finding the right person for this role. If you know someone who would be an excellent Executive Director for the PHP Foundation, please encourage them to apply or reach out to us directly.

The full job description and application details can be found below.

For questions about the search process, please contact ed-search@thephp.foundation.

🐘💜

Executive Director – The PHP Foundation

Position Type: Full-time or Part-time (if part-time, responsibility includes hiring necessary staff to fulfill the complete role)
Location: Remote, no visa opportunity
Reports To: Board of Directors
Term: 1 year, renewable subject to annual performance evaluation
Compensation: Total Compensation $90,000-$160,000 (Base: $90,000 - $105,000 USD / year, Performance based bonus up to $65,000 USD)

About The PHP Foundation

PHP is one of the world's most widely-used programming languages, powering millions of websites and applications. The PHP Foundation is a collective of people and organizations relying on the PHP language. Its mission is to ensure the long-term prosperity of the PHP language.

The PHP Foundation focuses on providing financial support and guidance to PHP language developers to support its goals of improving the language for its users, providing high-quality maintenance, and improving the PHP language project to retain current contributors and to integrate new contributors.

The PHP Foundation aims to promote the public image of the PHP language in the interest of retaining existing and gaining new users and contributors.

The PHP Foundation operates as a collective under the Open Source Collective, a 501(c)(6) non-profit organization based in the United States. The Executive Director role will be structured as a contractor position with this entity.

The Role

The Executive Director serves as the operational leader of the PHP Foundation, defining its strategic vision and translating it into reality while managing day-to-day operations and serving as the primary bridge between the Board, staff, community, and sponsors.

While the programming language PHP is over 30 years old, the PHP Foundation was only created in 2021. The Executive Director will be responsible for maturing the foundation’s internal structure and will play a crucial role in ensuring the foundation can effectively support this vital ecosystem.

Key Responsibilities

Strategic Leadership

• Develop strategic initiatives for the PHP Foundation and the PHP language in alignment with the foundation's mission and goals
• Annual presentation of new strategy and evaluation of previous year’s performance to the Board for approval
• Develop and implement marketing strategies to fulfill the foundation’s mission to promote the public image of the PHP language

Fundraising & Financial Oversight

• Responsible for fundraising to provide the budget for implementing proposed strategy
• Manage finances, budgets and fundraising
• Prepare quarterly operations summaries and financial statements

Operational Management

• Manage day-to-day operations, staff, including contracted PHP core developers
• Oversee hiring, performance management, and development of Foundation staff
• Ensure efficient execution of foundation programs and initiatives
• Provide regular updates at board meetings

Stakeholder Relations

• Represent the foundation externally and maintain relationships with sponsors, partners, and community stakeholders
• Serve as the public face of the foundation at conferences and community events

Required Qualifications

• Demonstrated leadership experience in relevant organizations or communities
• Strong project management and organizational skills
• Excellent written and verbal communication skills
• Financial management and budgeting experience
• Proven ability to work with diverse stakeholders and build consensus

Additional Experience We Value

• Experience in free and open source software communities
• Knowledge of the PHP ecosystem and its community dynamics
• Experience in fundraising or sponsor relations
• Network within the PHP community
• Experience managing remote teams
• Public speaking and presentation skills
• Previous experience in open source foundation governance
• Experience in or working with public relations or marketing

Compensation and Terms

• Contracting position with Open Source Collective 501(c)(6)
• Fully remote, no visa opportunities
• At full-time, base pay of $90,000 - $105,000 / year, invoiced monthly
• Annual performance based bonus up to $65,000 tied especially to fundraising goals
• Travel to a few community events per year required with expenses covered, additional travel encouraged if event organizers cover expenses
• Renewable annually based on performance and mutual agreement with Board of Directors

Selection Process

A search committee of Board members and community representatives is managing the candidate search and evaluation process. The process includes:

1. Application review and initial screening by the search committee
2. Interviews with the search committee
3. Committee presents top candidates to the full Board of Directors
4. Presentation of vision and strategy to the full Board
5. Final selection by full Board vote (2/3 majority required)

Applications will be accepted on a rolling basis until 2025-12-15.

How to Apply

Please fill in our Google form including:

• Cover letter describing your interest and relevant experience
• Resume/CV
• Brief vision statement (500-1000 words) addressing: your understanding of the foundation's current position, key opportunities and challenges you see for the foundation, and your approach to the role
• During the interview process we will ask you to provide at least 3 references who we can contact

Questions about the position or application process? Contact: ed-search@thephp.foundation.