The PHP Foundation
The PHP Foundation
Germany is spending €108 million to move its federal websites onto a PHP application.
The money is the budget for the eleventh version of the Government Site Builder, the German federal administration's standard content management solution: €26.88 million for product development and support, €73.2 million for migration and relaunch, €8 million for operations, phased over four years. More than 80 federal agencies and institutions already use it, and they have built well over 250 websites with it.
In 2025, The PHP Foundation received $730,534 in total contributions.
I am not going to argue from those two numbers that PHP deserves better treatment. What I want to describe is something that has gone largely unnoticed, including by those of us who work on PHP: across Europe, public administrations have already decided what their digital infrastructure runs on. They decided it in procurement documents, framework agreements, and coalition agreements. And when those documents say "digital sovereignty", what they describe, over and over, is a PHP application.
The European Commission is the largest case: At the Drupal4Gov EU conference in Brussels in January 2026, the team behind the Europa Web Publishing Platform described what they operate: 770 live sites for 44 different Commission services, 700 million visits and 2.2 billion page views per year. The move to a shared Drupal platform began in 2019, because letting each Directorate-General maintain its own customised codebase had made security patching and consistent user experience progressively harder. The reusable parts are public, in the OpenEuropa and ec-europa organisations on GitHub.
The European Union Aviation Safety Agency runs its Sustainability Portal on Drupal: a regulatory compliance platform serving over 350 airlines and 31 national authorities for the ReFuelEU Aviation regulation. Analytics run on Matomo, email on Mautic. Three PHP applications carry an aviation compliance regime.
In the Netherlands, DICTU's GovNL CMS brings government website deployment down from three months to ten minutes using design tokens, Drupal Recipes, and automated infrastructure. In France, the Drupal base theme for the state design system is monitored by the Service d'Information du Gouvernement and DINUM, so the French state supervises PHP code as part of its own design authority. In the United Kingdom and Ireland, LocalGov Drupal has over 58 councils sharing a common codebase and pooling development budgets, with reported savings of 50 to 80 percent against building a council website from scratch. In Australia, GovCMS hosts more than 370 websites for 115 government agencies, has been running for over a decade, and holds an OFFICIAL:Sensitive security classification.
Not one of these is a pilot project. Each of them carries the everyday traffic between a government and the people it serves.
The German case is worth looking at closely, because the decision is documented rather than inferred.
The Government Site Builder (GSB) became, in version 11, a measure under the federal Ministry of the Interior's service consolidation programme. It is built entirely from open-source components and published on the OpenCoDE platform, and it is based on TYPO3. The evaluation that led there had narrowed the field to Drupal and TYPO3: the shortlist for the German federal government's standard content management system consisted exclusively of PHP applications. The work was then split. A consortium led by CPS, with 3pc, brandung, DFAU, in2code, THE BRETTINGHAMS and queo, develops GSB 11 itself over four years. In March 2025, a consortium of 17 TYPO3 agencies led by the Materna Group won the migration lot and will move hundreds of federal websites across.
The most telling detail is not German at all: When Swiss parliamentarians criticised their own federal administration for procuring a closed-source CMS, they held up the German decision as the model to follow: "Deutschland machts vor", Germany is showing how it's done. A national decision to standardise on a PHP application is now cited in a foreign parliament as best practice.
In these programmes, digital sovereignty is described in practice by naming specific pieces of software.
The ITZBund's Bundescloud includes the SIB-Box, built on Nextcloud, serving roughly 300,000 federal users. openDesk, the sovereign workplace built by the Zentrum für Digitale Souveränität, integrates Nextcloud alongside Collabora, Element, Open-Xchange, OpenProject, and XWiki. It is anchored in the German coalition agreement: by October 2028 the federal administration is to have a digitally sovereign alternative to proprietary IT workplaces. The state of Baden-Württemberg has already migrated close to 60,000 teacher workplaces; the Bundeswehr has a framework agreement; the Robert Koch Institute and several ministries run components in production. The International Criminal Court in The Hague intends to adopt it.
Nextcloud Server is a PHP application: versions 33 and 34 support PHP 8.2 through 8.5, and the administration manual still opens the installation chapter with PHP configuration. That claim needs a caveat, because the picture has changed: the Files High Performance Backend is written in Rust, and the ADA engine announced in 2026 rewrites the file access layer in PHP, Go, and Rust. PHP carries the application and the business logic, but the I/O-bound paths increasingly do not. MediaWiki, which runs Wikipedia, is built the same way.
€108 million for one national migration. 770 sites at the European Commission. 370 across the Australian government. Around 300,000 users in the German federal cloud. Tens of thousands of teacher workplaces in one German state alone.
And $730,534 in contributions to The PHP Foundation in 2025, from 536 organisations and individuals, substantially fewer than the previous year, with expenses exceeding donations by roughly $139,000, a deliberate choice to maintain technical headcount. Thirteen contracted engineers maintain the language underneath all of it.
I want to be careful about the conclusion here, because nobody in this story has acted badly. What the numbers show is a structural gap: the institutions most dependent on PHP have no established mechanism by which that dependency turns into maintenance funding. Nobody designed that gap; it is what happens when infrastructure is free at the point of use.
One institution has already built the mechanism. The Sovereign Tech Agency, funded by the German government, commissioned work that produced the PHP-FPM Web Services Tool and the evolution of PHP's stream layer for async, security and performance. Public money went into the substrate and shipped capability came back out. The mechanism exists and it works. What it lacks is the habit of being used.
At Drupal4Gov EU, Tiffany Farriss, now Interim CEO of the Drupal Association, proposed a set of procurement changes that translate directly to any language ecosystem. They are worth repeating here because they require no goodwill, only a change to how tenders are scored, and because the first of them fits inside a framework that European procurement already uses:
An administration that adopts these does not need to know or care that its CMS is written in PHP. It only needs to accept that the code it depends on has maintainers, and that maintainers have budgets.
If you work in or with a public administration: the software your organisation depends on almost certainly includes several PHP applications, and quite possibly the ones your sovereignty strategy is built around. The three proposals above belong in your next tender rather than in your next strategy document.
If you are an agency delivering these contracts: put the line item in the bid. You are in a better position than anyone to make upstream maintenance a normal cost of delivery rather than an act of charity.
And if you know a case we have missed, a ministry, a municipality, a health service, a statistics office running on PHP, tell us. This article covers Europe and one Australian platform because that is as far as the research went. We would like to publish those cases here, written by the people who built them.
