[Disclaimer: I have nothing to do with this foundation, but the post makes a lot of good points.]
…
The asymmetry
€108 million for one national migration. 770 sites at the European Commission. 370 across the Australian government. Around 300,000 users in the German federal cloud. Tens of thousands of teacher workplaces in one German state alone.
And $730,534 in contributions to The PHP Foundation in 2025, from 536 organisations and individuals, substantially fewer than the previous year, with expenses exceeding donations by roughly $139,000, a deliberate choice to maintain technical headcount. Thirteen contracted engineers maintain the language underneath all of it.
I want to be careful about the conclusion here, because nobody in this story has acted badly. What the numbers show is a structural gap: the institutions most dependent on PHP have no established mechanism by which that dependency turns into maintenance funding. Nobody designed that gap; it is what happens when infrastructure is free at the point of use.
One institution has already built the mechanism. The Sovereign Tech Agency, funded by the German government, commissioned work that produced the PHP-FPM Web Services Tool and the evolution of PHP’s stream layer for async, security and performance. Public money went into the substrate and shipped capability came back out. The mechanism exists and it works. What it lacks is the habit of being used.
…
What would make it normal
- A sovereignty criterion with real weight: Twenty percent of tender evaluation points awarded for verified open-source contributions, as a distinct assessment criterion under the MEAT framework, the Most Economically Advantageous Tender. That puts software transparency and digital sovereignty next to the qualitative, environmental and social criteria a tender is already allowed to score.
- A maintenance line item: A share of contract value allocated to upstream maintenance of the components the delivery depends on, budgeted at the outset rather than found later. Farriss deliberately does not fix the number and would rather see one settled in public: her own estimate is 2 to 5 percent, depending on the budget and the duration of the project, and up to 10 percent on complex ones.
- A 30-day upstream rule: Non-sensitive code developed under public contract contributed back within 30 days, so that the next administration inherits it instead of paying for it again.
An administration that adopts these does not need to know or care that its CMS is written in PHP. It only needs to accept that the code it depends on has maintainers, and that maintainers have budgets.
…