Germany spends €27 million a year migrating its federal websites onto PHP. It contributes €112,000 a year to PHP security.
The ratio is 241:1.
On 21 October, two critical PHP vulnerabilities forced seven countries to shut down government services in a single afternoon. The Netherlands pulled DigiD offline, cutting 17 million citizens off from digital identity. Finland shut its entire government web presence. The UK took 32 services down and issued 50,000 warnings.
Every government in every country waited for the same patch from the same 11 part-time developers.
The vulnerabilities had existed since 2004 and 2012. Two prior audits found signs of both flaws but could not construct working exploits. In August 2026, two independent teams using frontier AI models collapsed a discovery timeline that had defeated human auditors for fourteen years into days. The bugs were not new. The capability to weaponise them was.
Seven weeks before PHP2Shell proved it, the PHP Foundation published an article titled "Digital Sovereignty Is Written in PHP." It documented the dependency governments had already built and the structural gap no funding mechanism had closed. Seven weeks later, that gap shut down services across seven countries.
I wrote a long-form article introducing a metric for this: the maintenance deficit ratio. It traces the failure through PHP2Shell and maps it across the entire sovereignty stack: LibreOffice, Nextcloud, FFmpeg, curl, OpenSSL, Kubernetes Ingress-NGINX. Every layer has a funding gap, a staffing gap, or both.
The dependency is global. Drupal runs on 33% of South American government websites. WordPress runs on 25%. All of them run on PHP. The countries that adopted open source because proprietary licensing was unaffordable have the deepest dependency, the least institutional response capacity, and no seat in any upstream funding mechanism.
Three mechanisms exist to close the gap. The Sovereign Tech Agency. Alpha-Omega. The Cyber Resilience Act's steward framework. The article explains why none is sufficient and what would be.
If your government is migrating onto open source for sovereignty, it should know its own maintenance deficit ratio.
One percent of Germany's €108 million migration contract is €1.08 million. The PHP Foundation's entire 2025 revenue was $730,534 from 536 donors. The EU's seven-year open source commitment equals roughly three days of its proprietary software bill. The money exists. The failure is a policy choice.
#DigitalSovereignty #OpenSource #PHP2Shell #CyberSecurity #MaintenanceDeficit