The UK organisation for the business of Open Technology

Open source security needs cash, not just pull requests

The PHP security crisis should be a wake-up call for an industry that has built extraordinary businesses on open source software, while leaving too much of the responsibility for maintaining it to a handful of underfunded developers.

Two critical vulnerabilities in PHP, the language underpinning an enormous share of the web, prompted frantic patching, emergency security advisories, and websites being taken offline. The vulnerabilities allowed unauthenticated attackers to execute arbitrary code on vulnerable servers.

But buried beneath the headline hype about AI-discovered vulnerabilities is a much bigger story: open source has a funding problem, and the companies that profit from it are not doing nearly enough to solve that problem. We’ve created a thriving market for managing the risks of underfunded software, without creating an equally effective market for funding its maintenance.

The tech sector has built an industry on someone else’s unpaid maintenance work.

The economics of open source are remarkable: a relatively small number of people can produce software used by millions of developers, thousands of businesses, and entire governments. The marginal cost of distributing it is practically zero. The value created can be astronomical.

But somewhere along the way, we confused free to use with freely maintained.

We happily pay cloud providers, observability vendors, security platforms, hosting companies, and AI providers. We spend vast amounts on software infrastructure and the tools to manage it. Yet the people maintaining the foundational components of that infrastructure often have to make do with donations, grants, sponsorships, and volunteer labour.

The entire PHP Foundation functions on under $1m a year.

Businesses spend substantial sums protecting themselves against vulnerabilities in open source software, but frequently contribute little or nothing to the projects responsible for fixing those vulnerabilities in the first place.

The PHP Foundation’s account of this week’s crisis is unusually candid. One of the vulnerabilities had roots in a memory-management problem first identified in 2024. Fixing it proved difficult, with competing solutions threatening compatibility, performance, or the wider extension ecosystem.

The work stalled repeatedly. The Foundation acknowledged that this was a structural failure, partly caused by a shortage of developers with sufficiently deep expertise. This wasn’t a case of maintainers not caring about security or needing more regulation. It was a case of an extraordinarily important software project struggling with difficult engineering decisions, limited capacity, and competing priorities.

AI-assisted security research is making it dramatically easier to discover the vulnerabilities in software that have existed across projects for decades. That is potentially wonderful for open source security. But vulnerability reports without the people to implement fixes and deploy them makes things worse. AI companies are raising hundreds of billions and garnering headlines for AI discoveries while failing to support the people who do the actual work in open source security.

Chainguard illustrates the uncomfortable economics. The company has built a commercial business around securing open source software supply chains. Its customers pay for hardened, maintained, and rapidly updated software artifacts. There’s nothing inherently wrong with that model: businesses paying for better packaging, security, and operational support is a perfectly legitimate way to create value around open source.

The more fundamental question is whether companies making money from securing, packaging, and distributing open source software are contributing enough to the upstream projects that make their businesses possible.

Providing hardened images is valuable work. Discovering vulnerabilities is valuable work. Helping test patches is valuable work. But so is the deeply unglamorous work of maintaining the underlying software, resolving decades-old architectural problems, reviewing changes, and coordinating the ecosystem.

The industry risks creating a perverse arrangement: significant commercial value accrues to companies selling protection, while the upstream maintainers bear much of the cost of keeping the underlying ecosystem secure.

Thankfully, not everyone is waiting for someone else to pay. On October 21, in the middle of the PHP security crisis, Sentry announced that it had allocated $1 million to open source maintainers and foundations this year.

Not $1 million in free credits or salaries it pays its own engineers – actual money. Among the beneficiaries? The PHP Foundation, receiving $45,000. Sentry also allocated funding to the Python Software Foundation, Ruby Central, Django Software Foundation, Packagist, and numerous individual maintainers and projects. This is what taking open source sustainability seriously looks like.

Sentry is also one of the driving forces behind the Open Source Pledge, an initiative encouraging companies to pay at least $2,000 per year for every developer they employ to open source maintainers and foundations. Companies including Posit, Sanity, CodeRabbit, HeroDevs, Mux, Zerodha, Astral, and others have joined the Pledge. As of this week, 37 member companies have collectively contributed more than $8.4 million to maintainers and foundations.

It demonstrates that meaningful financial support for open source is entirely compatible with running a successful commercial software business. Contributions are important. But money matters.

Yes, companies contribute back in other ways: bug fixes, employing maintainers, publishing research, improving documentation and so on. It all helps. But we shouldn’t use those contributions to avoid an uncomfortable conversation about money.

A pull request doesn’t pay for someone to review the next hundred pull requests, and a vulnerability report doesn’t fund the engineers needed to fix it.

Cash also provides something that many other contributions don’t: flexibility. It allows foundations to hire maintainers, retain expertise, commission audits, fund unglamorous maintenance, improve security processes, and build resilience. It allows projects to decide for themselves what work matters most, rather than having their priorities dictated by whichever commercial contributor happens to show up.

To its credit, Chainguard contributed $50,000 to the PHP Foundation on October 21.

Open source is infrastructure. We need to start funding it like infrastructure.

Open Source Pledge members have demonstrated that a different model is possible. Now it’s time for more companies, especially those whose business models directly monetise open source software and its security, to follow their lead. And this is something OpenUK has been advocating for in its work towards a Foundation for the UK, which would include funding open source as part of its national remit.

Author: Mathew Lodge, Board Director, OpenUK and Chief Product Officer, Aguru