Live data from Hacker News

PHP Core Security Audit Results

thephp.foundation

11–20 of 72 posts

Re: PHP Core Security Audit Results

#12
post #6
post #4

Huge shout-out to the PHP Foundation for this. Last year, it received close to 680K USD, and managed this security audit, sponsored 10 developers, and paid for various expenses. For a language that runs close to 75% of the web, it certainly deserves more funding. Some of the recent initiatives from the Foundation ( https://thephp.foundation/blog/2025/03/31/transparency-and-i... ) : - All PHP versions now receive a to…

>>> Last year, it received close to 680K USD, and managed this security audit, sponsored 10 developers, and paid for various expenses. For a language that runs close to 75% of the web, it certainly deserves more funding. Wow, Automattic itself donated more than half of it: Silver Sponsor $387,500 USD Why many donors with more than USD 24K and USD 100K still listed as Silver sponsor? Source: https://opencollective.com…

[deleted]

Re: PHP Core Security Audit Results

#13
post #7
post #6

Earlier quoted context omitted.

>>> Last year, it received close to 680K USD, and managed this security audit, sponsored 10 developers, and paid for various expenses. For a language that runs close to 75% of the web, it certainly deserves more funding. Wow, Automattic itself donated more than half of it: Silver Sponsor $387,500 USD Why many donors with more than USD 24K and USD 100K still listed as Silver sponsor? Source: https://opencollective.com…

Why does Laravel have a dude with a Hawaiian shirt, though? Heh

It's the creator of Laravel, Taylor Otwell

Re: PHP Core Security Audit Results

#14
post #6
post #4

Huge shout-out to the PHP Foundation for this. Last year, it received close to 680K USD, and managed this security audit, sponsored 10 developers, and paid for various expenses. For a language that runs close to 75% of the web, it certainly deserves more funding. Some of the recent initiatives from the Foundation ( https://thephp.foundation/blog/2025/03/31/transparency-and-i... ) : - All PHP versions now receive a to…

>>> Last year, it received close to 680K USD, and managed this security audit, sponsored 10 developers, and paid for various expenses. For a language that runs close to 75% of the web, it certainly deserves more funding. Wow, Automattic itself donated more than half of it: Silver Sponsor $387,500 USD Why many donors with more than USD 24K and USD 100K still listed as Silver sponsor? Source: https://opencollective.com…

Crazy that Automattic only makes 4,843,750 a year (and donates 8% to the PHP foundation).

Re: PHP Core Security Audit Results

#15

I am genuinely interested why anyone would start a new project in PHP currently. What are the reasons?

TL;DR Your dad's PHP is no longer the current PHP. The language itself has been thoroughly modernized, made more consistent, bug free and performant. There is nothing better than a piece of software that keeps getting improved decade after decade borne out of real developer needs and experience.

- Type annotations are integrated and work well with PHP now. This results in a kind of scripty Java OOP that is more succinct and type checked ! (it is possible to write PHP without types when you want metaprogramming features also)

- Many inconsistencies in the design of the language (OOP, function naming etc.) have been resolved/smoothed out

- The language recognises the inherent problems with `null` and allows you to make type annotations that rule out null. This is my smell test for a language BTW -- golang for instance does not seem to have a good story for null.

- PHP Language developers have been really good about increasing performance year after year

- Lots of software like web frameworks and CMSes continue to be based on PHP

And -- the greatest part of the design -- PHP remains the best example of the "shared nothing" architecture. An architecture that allows you to scale your application easily.

Re: PHP Core Security Audit Results

#16

I am genuinely interested why anyone would start a new project in PHP currently. What are the reasons?

I legit started a new customer project (simple business website) on PHP a cple days ago:

The reason is simple: It's to me the most efficient, best performant SSR option out there, if your requirements are simple.

You will be amazed at the website's speed. We are so used to the lethargic JS slop of the average website out there these days.

I love PHP, I believe future "vibe coders" will be left bedazzled at its powers, which will be beyond their comprehension.

Re: PHP Core Security Audit Results

#17

I am genuinely interested why anyone would start a new project in PHP currently. What are the reasons?

Because it's good enough for almost everything. The vast majority of projects will never have to scale to billions of users, so hyperscalability is not a huge concern.

It has a low barrier to entry and great language features - static typing being one of the big ones. It has become a really nice language over the years, great to work in and in no way less satisfying or effective than for example golang.

And, of course, laravel exists.

Post reply on HN