Lack of staff and funding likely led to the recent PHP security snafu; project has only one full-time employee, but that's just the tip of the iceberg — a dreary situation caused by services running old versions with no support
www.tomshardware.com
Never underestimate the power of complacency, the destroyer of internets.

70% of the world’s internet btw, but out-of-support deployments and little funding for permanent staff to manage the open-source project.