← All insights ←

Open source in the boardroom: How exposed are our systems?

By · Published: 24 October 2026

Risk ManagementCybersecurityBoard of DirectorsOutsourcing
Open source in the boardroom: which components carry our business?

Much has been written about the latest PHP vulnerability; very little about the real problem behind: Around 70 per cent of websites run on PHP. The language is maintained by a foundation with a single full-time employee and 14 mostly part-time contractors. Its executive director, Elizabeth Barron, says so herself: ‘PHP is incredibly under-funded.’

What it means became clear on 21 October. Government agencies, hospitals and companies in several countries took their websites offline as a precaution; Palo Alto Networks counted more than 22 million potentially vulnerable servers. The cause had been sitting in the code for more than a decade.

A tool that became infrastructure

PHP began in 1994 as a small tool for Rasmus Lerdorf’s personal home page. ‘I had no intention of writing a language,’ he said later. Security was not a design goal at the time; according to Lerdorf, cross-site scripting did not even exist in 1995. Thirty-two years on, government portals and online shops around the world run on it.

Known, documented, left undone

The interpreter is written in C, a language that does not catch memory errors. The underlying memory weakness had been known since 2020. It resurfaced in 2024 during an audit funded by Germany’s Sovereign Tech Agency. Because no attack path was known, the fix was put on hold. The foundation itself calls this a structural failure, caused by its decision process and a lack of resources.

Catching up under pressure

The flaw only became a priority when several security firms reported it independently in August. Since 1 July, the foundation has published 15 vulnerabilities and received more than 100 further reports that were invalid or duplicates. Over the summer it hired two additional engineers. It is now asking companies and public bodies that rely on PHP to help fund its security work.

A question of dependency

For the board, this is a question of dependency. Open source carries no licence fee, but the licence excludes warranty and liability. There is no contract with an agreed response time. Anyone who builds their platform on it carries this risk themselves.

Two questions for the risk map

Two questions therefore belong on the risk map: which open-source components carry our business? And who pays for their maintenance when a fix sits untouched for two years?

Tasks can be delegated, technology outsourced. But accountability cannot.

Transparency note

Generative AI was used in a supporting role for the research and editorial preparation of this article. The conceptual design, the selection and weighting of the content, the expert assessment, the final wording of the text and the responsibility for all statements and conclusions rest with me.

Sources