Commit

90aacef

meh, he's not saying anything new or enlightening, and I think he's conflating what really matters (php foundation being resource constrained) with something that doesn't matter (active exploitation). the former is real, painfully obvious and problematic. the latter is something only *he* cares to monitor, while the general public will assume there are a ton of sites being hacked.

commit 90aacef

Why does it have to be one or the other? The PHP Foundation is underfunded AND monitoring active exploitation matters. Both can be true.