Last year, it received close to 680K USD, and managed this security audit, sponsored 10 developers, and paid for various expenses. For a language that runs close to 75% of the web, it certainly deserves more funding.
Some of the recent initiatives from the Foundation (https://thephp.foundation/blog/2025/03/31/transparency-and-i...) :
- All PHP versions now receive a total of 4 years of security updates; 2 bug fixes + 2 security, up from 3.
- PIE: A replacement for PECL, to easily install PHP extensions (C, C++ compiled, not PHP packages).
- The security audit.
(I'm one of the PHP Core team and a volunteer at the foundation, happy to answer any questions, but almost all of the work is public)