And it's not cheap to pay that many people, especially not full time (which is partly why they don't have more full-time contractors). According to https://opencollective.com/phpfoundation#category-BUDGET they only have a balance $350k currently, sinking.
It'd be really awesome, if more companies would sponsor the PHP foundation (especially with thousands or tens of thousands of dollars per year. A lot of small contributions is nice, but not enough.). The work of a few core maintainers is really crucial to the continued development of PHP.
m4xp 5 hours ago [-]
Who needs php when they are giving 10mill for some vibecoded dotfiles.
MattGaiser 19 hours ago [-]
Are there many serious companies using PHP?
It overwhelmingly seems like the language of the cheap and not very technical or providers of services to the cheap and not very technical.
justinator 18 hours ago [-]
It's used on Pornhub so it's both very useful and very important but excuse me princess if it's not on the next Mars lander robot.
hdjrudni 17 hours ago [-]
Naughty America uses it too. We met some guys from there in a hot tub at the hotel we were staying at for a PHP conference.
justinator 17 hours ago [-]
I know AI gets the headlines but PHP is what's putting food on tables in this industry.
cucumber3732842 16 hours ago [-]
The entire internet from that era is still built on it.
I worked at a major CDN with roots in the dot com era. PHP errywhere. You wanna log on and see your bill you're invoking like 40 different (modern containerized) lamp stacks.
pluc 6 hours ago [-]
and Facebook
jerf 19 hours ago [-]
It is used all over the place in ways you don't even realize. "not very technical or providers of services to the cheap and not very technical" is a particular corner of the market that is visible and full of PHP, sure, but you don't see the huge masses of PHP code running that doesn't expose a .php on the end of the URL.
4ndrewl 19 hours ago [-]
It's mainly used by profitable and/or public sector orgs, so unlikely to have much intersection with the HN crowd.
tdeck 16 hours ago [-]
Unfortunately those sound like organizations that wouldn't see much value in the goodwill generated by funding PHP.
40four 16 hours ago [-]
I understand why people still have this perception, I imagine due to relics of the past of the PHP 5 (or earlier) era. But those days are long gone, and I believe PHP 8 has some a nice job of adding modern features and improving developer experience.
Wordpress is the obvious answer to your question, but its codebase is admittedly still stuck in the past in many ways. Nobody would write it that way if they were starting from scratch today.
There are plenty of “serious” companies using Laravel or Symfony. Take a look around those codebases if you want to get an idea of what solid modern PHP design patterns look like nowadays. Nothing “cheap or not very technical” about them :)
wyclif 16 hours ago [-]
Know who uses PHP? Companies that actually make money.
card_zero 16 hours ago [-]
Some Amazon sites, they said. Lots of random companies and institutions: a Danish IT company, a Dutch cybersecurity company, Orange telecoms (in France). Various governments' sites for various services. Some BBC TV show pages, a gym group, a Japanese airline, Asahi (the brewers), Finland's state IT provider.
BadBadJellyBean 19 hours ago [-]
Wordpress and Nextcloud are two very prominent pieces of software that come to mind that are built on PHP. I'm sure there is more out there.
swat535 18 hours ago [-]
I suppose my question would be: what would be the reason to choose PHP in 2026 for a greenfield project over the plethora of other available languages?
BadBadJellyBean 4 hours ago [-]
Even if not that doesn't matter. There is a lot of software out there that is very actively developed and based on PHP. So it's very odd that they are so underfunded but on the other hand it's probably a marketing problem. I didn't know about that since this post.
40four 15 hours ago [-]
Laravel is one of the most comprehensive and best developer experiences around. Give it a spin of you haven’t tried it.
chiffaa 5 hours ago [-]
I wanted to give Laravel a spin to have PHP+Laravel under my belt for future. `laravel new` couldn't even initialize a project fully, which might be the first time I've seen a framework-specific setup tool fail this fast
swat535 15 hours ago [-]
I asked a genuine question. Does Laravel deliver a superior developer experience than let's say Rails or Djano?
Like if I were to sell PHP in 2026 to a new team, how would I position it?
dofm 13 hours ago [-]
It does. Just look at quality of the documentation for starters.
Laravel is really excellent. PHP’s package manager, Composer, is great, and Laravel makes excellent use of it. The two main front end tools, Livewire and Inertia, are fun, with good starter kits. It has an elegant built in AI SDK, an official LLM developer integration, good payments support. There’s a new typescript binding. It has, IMO, one of the few truly well-designed ORM implementations.
There’s an incredible community around it. Lighthouse, the schema-first GraphQL package, is one of the neatest I have seen.
And PHP 8.x is a much more capable language than people expect. LLMs speak it well and are typically very up to date with its capabilities.
ETA: I think one of the things that sets it apart from other environments is the sense that it has a mature clarity of purpose, to be honest. In this AI-slop-documentation era, have a look at the documentation, the clarity of it, the ease of onboarding. Laravel as a project tends to execute well on ideas, has sensible defaults etc.; it just feels grown-up. It moves a little slower than other frameworks in terms of innovation, but sweats the details. It also has a well-managed upgrade process.
Unfortunately, I think PHP, and ultimately Ruby, Python, Perl, and Node.js, will all eventually be proven to be inappropriate for web development. It feels to me like we are heading away from a world where every application sits on top of an interpreter and a huge attack surface.
For myself, I really like Laravel; I have deployed apps in it that did good things for people and it was never once in my way. It has been fun, simple, even quite poetic to use. But I think I am done with these sorts of programming environments, and I am going to force myself back to things with a smaller footprint.
I certainly think that one aspect of PHP has to change, and that is the tendency to deploy with distro packages. That is clearly an inappropriate burden in the LLM-assisted hacking era.
4thguy 3 hours ago [-]
GOG was down during the mad scramble this week, so there's that
bawolff 18 hours ago [-]
Facebook (although they forked it)
Wikipedia
Wordpress
wingmanjd 19 hours ago [-]
Netgate (behind pfSense) use PHP for their firewall administration interface.
There were a lot of sites affected by the later exploits, so I will say, yes.
tdeck 16 hours ago [-]
Slack's backend is PHP I believe.
youngtaff 8 hours ago [-]
Oh sweet child…
cyanydeez 18 hours ago [-]
Isn't there some large php based software run by a bruised ego who can't even get his own house in order, let alone help fund his largesse, but complains about his leeches.
Hrmmm.
Hamuko 19 hours ago [-]
Is Facebook still using it?
Also, not a company but Wikimedia Foundation definitely has some funds too.
pkaye 19 hours ago [-]
I think Facebook switched to their own language Hack a decade ago.
damontal 19 hours ago [-]
Didn’t they roll their own version of it?
brettermeier 18 hours ago [-]
How old are you?
gchamonlive 20 hours ago [-]
There are countless applications out there still running on PHP, but if the community interest can't raise the required resources to maintain the tool, maybe it's time for it to die, or at least downgrade into maintenance mode so in time it'll become a legacy language.
dofm 13 hours ago [-]
The “community” has only just managed to find the resources to maintain NTP. I think if “nobody is donating” is your standard for whether things should live or die, then we are all hopelessly fucked.
gchamonlive 13 hours ago [-]
My standard is not having a single full-time employee without the proper resources to maintain the technology. If the community would find the resources, all is well, but better than to run it on fumes would be to give everyone time to move on.
dofm 12 hours ago [-]
OK, but you understand that by that same standard you’d have sunsetted NTP. Harlan Stenn was maintaining it for a pittance; nowhere near a full developer salary.
gchamonlive 12 hours ago [-]
How do they call it, it's the "business risk"? Who am I to question it. Let's just take care nobody loses an eye in the process.
londons_explore 20 hours ago [-]
If they asked harder for donations, they would surely raise enough for maintenance.
Plenty of companies can donate 0.1 engineers to work on php, if for no other reason than to make php better for their own use cases.
gchamonlive 19 hours ago [-]
The mythical engineer-hour, has this ever worked? Maybe for an already stabilished dev team...
And asking harder? How does harder look like in comparison to regular asking?
hdjrudni 17 hours ago [-]
I imagine it looks like Wikipedia. Every year they have a big campaign...
gchamonlive 15 hours ago [-]
But Wikipedia their main product is the webpage, for PHP, people visit it and their docs occasionally, that sure wouldn't have the same impact.
Better than running on fumes would be to honourably phase out and give people time to move on.
ValentineC 18 hours ago [-]
If Automattic funded the PHP Foundation with 8% of their revenue [1], like what Matt Mullenweg asked from companies using WordPress [2], the PHP Foundation would have lots of money.
I take your point and it’s not 8% of their revenue, I guess, but they do give the PHP Foundation a quarter of a million dollars a year. AFAIK they are the biggest contributor?
Heck, I imagine that 1% would still be a total game-changer.
NewJazz 16 hours ago [-]
He seriously asked for 8% of revenue? What a massive dolt. Most businesses don't even have a profit margin that high.
grokys 20 hours ago [-]
And then people complain about "bait and switch " or "pulling the rug" when an OSS project becomes successful and tries to fund itself in some way. "But that should be free" shouts everyone. I'm increasingly coming around to the idea that OSS was the biggest swindle the corporations managed to pull off.
u1hcw9nx 9 hours ago [-]
Select the right OSS license and use dual licensing.
GPL/AGPL/LGPL is the way to go for business. There are many dual-licensing success stories using GPL/AGPL, both large and small: Qt, iText, Grafana, Loki, Tempo, Mattermost, Cal.com, Baserow, and even MongoDB originally.
Qt is an especially interesting case because KDE and the Qt Company have a written contract. Qt can't just switch licenses. They have retreated from every voluntary contribution to open source, but the contract binds them and they can't do anything to it unless they do complete rewrite from scratch.
acoustics 20 hours ago [-]
I can't speak for anyone else, but I don't mind at all when an open source project switches licenses or whatever. They gave away the fruit of their labor, but I am not entitled to any more of it.
What does bother me is when the projects pivot to claiming that users now have a moral obligation to financially support the project. There is a kind of dishonesty in this move.
It's not that a successful project "should be free", it's that its success depended on it being free. If they had said all along that they'd eventually ask users to pay, that would be honest... but then they wouldn't have seen much of that adoption in the first place.
grokys 20 hours ago [-]
In my case, I never intended on my open source project becoming popular, it just did and I had to either abandon it or make it my job. I'm not sure where that falls in your judgement.
I suspect this is also the case for PHP though.
acoustics 20 hours ago [-]
It's your project, to the extent that you own the copyright. You are free to switch the license on your project, etc. If anyone tries to shame you for this, you should pay no mind. (Edited to add that you are also free to abandon it, and you could do that with a clear conscience.)
Likewise, users are free to continue using open source software without payment or donation, to fork the project, etc. If anyone tries to shame them for this, they should pay no mind.
carlosjobim 20 hours ago [-]
Why would you have to abandon it instead of just keeping on in your preferred pace? If anybody wants more rapid development they can fork it, not your problem.
nicce 19 hours ago [-]
Some people also have tried the paid new feature prioritization where it later lands for everyone. I think it worked in some projects but project must have been really good otherwise.
grokys 19 hours ago [-]
I mean: who doesn't want to work full time on their passion project? Especially when I'd just been made redundant, I feel most people would do the same.
hdjrudni 17 hours ago [-]
Full time on passion project only makes sense if you're also getting paid a decent salary. Full time for a bunch of free loaders does not make sense.
Also it gets less fun when people start making demands of you and you have to deal with taxes and all the unfun stuff.
bawolff 18 hours ago [-]
> I can't speak for anyone else, but I don't mind at all when an open source project switches licenses or whatever. They gave away the fruit of their labor, but I am not entitled to any more of it
It only bothers me when they try to claim their new license is open source or use misleading language when it isn't. Which seems to be what 90% companies doing that do.
People can do whatever they want with their intellectual property as long as they aren't lying about it.
anonymous908213 20 hours ago [-]
I've been shouting this from the rooftops for ages now. OSS is a trojan horse, something meant to devalue the work of independent developers/small businesses and ensure that the only way the software can be supported is through the patronage of big tech, who earn the money to control such OSS through their unethical monopolistic practices. Look at the languages with funding, and where it comes from. C and C++ (both LLVM and GCC), C#, JS/TS, Java, Rust, Go, Python are all directly funded by big tech. The naive idealism results in everything falling into the hands of ~10 corporations plus some VCs who gamble on which ones will become worth acquiring by big tech, and then we wonder why everything goes to shit and our entire ecosystem is so user-hostile.
cedilla 19 hours ago [-]
I'm not saying that big tech isn't hijacking open source software, but that does not mean that free or OSS was always "meant to devalue" devs or small companies.
Until very recently, big tech pumped untold millions of dollars into obliterating FLOSS altogether, calling it a cancer that will destroy any enterprise it touches.
anonymous908213 19 hours ago [-]
You mean just Microsoft. Microsoft was an outlier. Even in the 90s, Linux and GCC were being funded by big tech. Obviously they were developed with the best of intentions, but I think it's accurate to say that OSS is "meant" to devalue developers because the purpose of a system is what it does, and that is what it does in practice.
cedilla 7 hours ago [-]
"The purpose of a system is what it does" is the weirdest cliché I encountered here, and that's not just because it is horoscope nonsense dressed up as a fact, but because it brilliantly illustrates how many people here think they just know what a system does on a glance.
But if it was true: In the 90s, millions of small businesses around the world used FLOSS to host websites and offer services over the internet. That was decidedly not the route big enterprises wanted to go. They wanted to push through big standards through ITU et al, build giant, patented moats, and host it all on big mainframes with huge Oracle databases.
Even today, there exist small to medium businesses in the hosting and shopware space, and they can only do that because big tech could not push them out of that space because FLOSS protected them.
engineerDave 18 hours ago [-]
Or Oracle, Adobe, … it’s more than just Microsoft.
grokys 20 hours ago [-]
And the indoctrination is so strong that even after all I've lived through and seen, my default is still "let's open source this".
eikenberry 19 hours ago [-]
This is why Free Software is important. It is about a lot more than just being open source.
matteoraso 18 hours ago [-]
This has long been an issue with open source projects.[0] If it were up to me, the government (any government) would fund every important project out there. It would be very cheap, and the payoff will be enormous.
She says the full-time member is herself, and looking at her Linkedin (in/elizabethn) she isn't exactly the person who would patch PHP for the two CVEs.
londons_explore 20 hours ago [-]
Presumably that's why there are also lots of part time contractors.
lwansbrough 21 hours ago [-]
Just hold a public yes/no vote on changing licensing to something paid, and charge $10 to vote no.
IshKebab 20 hours ago [-]
I imagine that would go down well and result in zero forks...
YetAnotherNick 20 hours ago [-]
So you think those forks will solve underfunding problem?
lwansbrough 20 hours ago [-]
Awesome dude let the scabs work for free lol
dingdingdang 21 hours ago [-]
Come on Facebook/Zuckerberg, set them up with a structured fund that is invested in s&p500 or something equivalent/better and allows them to pay a handful of devs and a person to admin them (all surplus can be earmarked to go to charity to avoid the sinkhole of bureaucracy from a larger org). Would set the PHP Foundation up for life and the whole world would be better off as a result, smallish directed investment with huge payout from a value perspective.
beering 6 hours ago [-]
They already did one better and upgraded the whole language in the form of Hack.
ivanmontillam 2 hours ago [-]
In your heart you know that's not a real contribution.
abroszka33 20 hours ago [-]
Not surprising at all. There are no incentives for anyone to contribute. And why would there be in this financial system?
rbanffy 20 hours ago [-]
> There are no incentives for anyone to contribute
If you like PHP, you might want to contribute. I like tmux, for instance, and I contributed code to them. I did the same for Sysdig, and a couple other projects.
abroszka33 19 hours ago [-]
I like a lot of things as well, yet I don't feel I can contribute after work. I already spend 8 to 10 hours at work. I can't find the motivation to do more.
rbanffy 3 hours ago [-]
We can always work something into our day jobs. We always bump into little things we can improve here and there.
abc42 19 hours ago [-]
There are lots of drives besides greed.
abroszka33 19 hours ago [-]
Of course there are. But do they matter in our current system?
abc42 10 hours ago [-]
I don't understand the question. Greed exists in every human system because it's a human quality, not a system quality. Real people are driven by many, sometimes conflicting things at the same time.
Non-greedy action is by definion an action that doesn't directly and materially benefit the one acting. That is universal across all political and I would argue all biological systems.
bawolff 18 hours ago [-]
And yet people do. PHP is a very active project.
comment0r 12 hours ago [-]
If Zig, which is much smaller than PHP, can attract a lot of money (relatively speaking, for its size): what is the PHP Foundation doing differently?
rcleveng 19 hours ago [-]
Agreed the budgets doens't seem like a lot, I wonder if in addition to some companies that make a lot of money using PHP funding a little, there are some opportunities to use grants or free services for nonprofits?
I noticed bills for both Workspace and GitHub (admittedly small amounts for Workspace, less small for GitHub)
If governments had to take down websites waiting for the patches this week then there are important users of php out there who have the money and should be contributing. I think php needs better public relations and people who can knock on the right doors to get funding.
Hamuko 21 hours ago [-]
The solution is obvious: pour trillions of dollars into Anthropic and OpenAI, and security will trickle down.
markvdb 19 hours ago [-]
First trickle down economics, now trickle down security!
bawolff 18 hours ago [-]
unironically yes.
Security improved one blockbuster vuln at a time.
Closed source might have more money but they almost never invest it in security.
mickeyhailu 5 hours ago [-]
[flagged]
aaron695 18 hours ago [-]
[dead]
pmlnr 21 hours ago [-]
xkcd 2347 again, what a surprise. Oh, wait, there's at least one paid person, that should be something /s
smashers1114 21 hours ago [-]
Presumably it makes sense to sunset PHP especially with how cheap code migrations are nowadays.
anonymous908213 21 hours ago [-]
Beating the dead horse, as you are: the Bun Rust migration cost millions of dollars in tokens and took an additional 3.5 months of labor after the widely-marketed "11-day rewrite" before being shipped as a release, and in the process introduced hundreds of new issues.
Sure if you ignore the many governments around the world that use PHP, the (still) most popular blogging software (which also has several ecommerce solutions bolted on top), wikis. The list goes on.
A pet peeve of mine is when people offer simple solutions that are only simple by virtue of ignoring all use cases that don't matter to the author.
Every interconnected system of concerns has simple solutions when you reduce it down and ignore the ordered effects.
jmull 21 hours ago [-]
What's easier, maintaining PHP or migrating/breaking every single PHP-based site?
And who's to say whatever sites are migrated to won't be "sunsetted" in a few decades too?
Seems like a no-brainer to maintain it.
smashers1114 20 hours ago [-]
Of course it has to be maintained. Things are maintained as they are sunset.
jmull 19 hours ago [-]
If maintenance continues indefinitely, then all good, (but then I wouldn’t use the term sunset).
glimshe 21 hours ago [-]
How cheap are code migrations nowadays? Vibe-migrations, you mean?
whatthejesus 21 hours ago [-]
Sounds like you’ve been snorting too much iron oxide.
thinkindie 20 hours ago [-]
migrating to what? just take a look at the newest CVEs, https://www.tenable.com/cve/newest , and you will see that no technology is spared by high or critical reports.
rbanffy 20 hours ago [-]
I agree a lot of PHP applications can be ported to other tools, but that only covers that much. Just look at banks and COBOL code.
https://opencollective.com/phpfoundation/transactions?search... and https://opencollective.com/php-foundation-eur/transactions?s...
(seems like "work" selects most of that)
And it's not cheap to pay that many people, especially not full time (which is partly why they don't have more full-time contractors). According to https://opencollective.com/phpfoundation#category-BUDGET they only have a balance $350k currently, sinking.
It'd be really awesome, if more companies would sponsor the PHP foundation (especially with thousands or tens of thousands of dollars per year. A lot of small contributions is nice, but not enough.). The work of a few core maintainers is really crucial to the continued development of PHP.
It overwhelmingly seems like the language of the cheap and not very technical or providers of services to the cheap and not very technical.
I worked at a major CDN with roots in the dot com era. PHP errywhere. You wanna log on and see your bill you're invoking like 40 different (modern containerized) lamp stacks.
Wordpress is the obvious answer to your question, but its codebase is admittedly still stuck in the past in many ways. Nobody would write it that way if they were starting from scratch today.
There are plenty of “serious” companies using Laravel or Symfony. Take a look around those codebases if you want to get an idea of what solid modern PHP design patterns look like nowadays. Nothing “cheap or not very technical” about them :)
Like if I were to sell PHP in 2026 to a new team, how would I position it?
Laravel is really excellent. PHP’s package manager, Composer, is great, and Laravel makes excellent use of it. The two main front end tools, Livewire and Inertia, are fun, with good starter kits. It has an elegant built in AI SDK, an official LLM developer integration, good payments support. There’s a new typescript binding. It has, IMO, one of the few truly well-designed ORM implementations.
There’s an incredible community around it. Lighthouse, the schema-first GraphQL package, is one of the neatest I have seen.
And PHP 8.x is a much more capable language than people expect. LLMs speak it well and are typically very up to date with its capabilities.
ETA: I think one of the things that sets it apart from other environments is the sense that it has a mature clarity of purpose, to be honest. In this AI-slop-documentation era, have a look at the documentation, the clarity of it, the ease of onboarding. Laravel as a project tends to execute well on ideas, has sensible defaults etc.; it just feels grown-up. It moves a little slower than other frameworks in terms of innovation, but sweats the details. It also has a well-managed upgrade process.
Unfortunately, I think PHP, and ultimately Ruby, Python, Perl, and Node.js, will all eventually be proven to be inappropriate for web development. It feels to me like we are heading away from a world where every application sits on top of an interpreter and a huge attack surface.
For myself, I really like Laravel; I have deployed apps in it that did good things for people and it was never once in my way. It has been fun, simple, even quite poetic to use. But I think I am done with these sorts of programming environments, and I am going to force myself back to things with a smaller footprint.
I certainly think that one aspect of PHP has to change, and that is the tendency to deploy with distro packages. That is clearly an inappropriate burden in the LLM-assisted hacking era.
Wikipedia
Wordpress
They recently posted about how to patch their software from the command-line (https://www.netgate.com/blog/critical-php-security-update)
There were a lot of sites affected by the later exploits, so I will say, yes.
Hrmmm.
Also, not a company but Wikimedia Foundation definitely has some funds too.
Plenty of companies can donate 0.1 engineers to work on php, if for no other reason than to make php better for their own use cases.
And asking harder? How does harder look like in comparison to regular asking?
Better than running on fumes would be to honourably phase out and give people time to move on.
[1] https://www.reddit.com/r/Wordpress/comments/1g6qi8i/automatt...
[2] https://techcrunch.com/2026/02/12/automattic-planned-to-targ...
https://www.therepository.email/automattics-anne-mccarthy-jo...
https://x.com/ThePHPF/status/1853390265429508427
GPL/AGPL/LGPL is the way to go for business. There are many dual-licensing success stories using GPL/AGPL, both large and small: Qt, iText, Grafana, Loki, Tempo, Mattermost, Cal.com, Baserow, and even MongoDB originally.
Qt is an especially interesting case because KDE and the Qt Company have a written contract. Qt can't just switch licenses. They have retreated from every voluntary contribution to open source, but the contract binds them and they can't do anything to it unless they do complete rewrite from scratch.
What does bother me is when the projects pivot to claiming that users now have a moral obligation to financially support the project. There is a kind of dishonesty in this move.
It's not that a successful project "should be free", it's that its success depended on it being free. If they had said all along that they'd eventually ask users to pay, that would be honest... but then they wouldn't have seen much of that adoption in the first place.
I suspect this is also the case for PHP though.
Likewise, users are free to continue using open source software without payment or donation, to fork the project, etc. If anyone tries to shame them for this, they should pay no mind.
Also it gets less fun when people start making demands of you and you have to deal with taxes and all the unfun stuff.
It only bothers me when they try to claim their new license is open source or use misleading language when it isn't. Which seems to be what 90% companies doing that do.
People can do whatever they want with their intellectual property as long as they aren't lying about it.
Until very recently, big tech pumped untold millions of dollars into obliterating FLOSS altogether, calling it a cancer that will destroy any enterprise it touches.
But if it was true: In the 90s, millions of small businesses around the world used FLOSS to host websites and offer services over the internet. That was decidedly not the route big enterprises wanted to go. They wanted to push through big standards through ITU et al, build giant, patented moats, and host it all on big mainframes with huge Oracle databases.
Even today, there exist small to medium businesses in the hosting and shopware space, and they can only do that because big tech could not push them out of that space because FLOSS protected them.
[0]https://www.fordfoundation.org/learning/library/research-rep...
If you like PHP, you might want to contribute. I like tmux, for instance, and I contributed code to them. I did the same for Sysdig, and a couple other projects.
Non-greedy action is by definion an action that doesn't directly and materially benefit the one acting. That is universal across all political and I would argue all biological systems.
I noticed bills for both Workspace and GitHub (admittedly small amounts for Workspace, less small for GitHub)
https://www.google.com/nonprofits/eligibility/
https://github.com/solutions/industry/nonprofits
Security improved one blockbuster vuln at a time.
Closed source might have more money but they almost never invest it in security.
A pet peeve of mine is when people offer simple solutions that are only simple by virtue of ignoring all use cases that don't matter to the author.
Every interconnected system of concerns has simple solutions when you reduce it down and ignore the ordered effects.
And who's to say whatever sites are migrated to won't be "sunsetted" in a few decades too?
Seems like a no-brainer to maintain it.