Popular PHP packages are more likely to have known vulnerabilities, large study finds

Researchers have once again validated a long-debated theory in software security: that more widely-used software tends to accumulate more reported vulnerabilities than less popular code. Their latest evidence comes from a sweeping analysis of the PHP ecosystem.

The study scope#

The work examined two distinct PHP-related datasets. The primary analysis covered approximately 400,000 open-source PHP packages, while a secondary analysis looked at over 6,000 WordPress components. These datasets allowed the team to test the relationship between download popularity and documented security issues across an enormous range of software.

What the results show#

Packages that had logged security vulnerabilities throughout their lifetime were, on average, more popular than those with few or no reported flaws. This finding supports the hypothesis that had been proposed in both academic research and industry conversation—but remained imperfectly tested until now. The pattern held consistently across both the broader PHP universe and the WordPress-specific subset.

Why this matters for security research#

The replication strengthens the empirical foundation for understanding how popularity and vulnerability disclosure intersect in real-world software. More popular code gets more scrutiny from users, researchers, and security teams, which typically leads to higher rates of vulnerability discovery and reporting. The inverse—that unpopular packages may harbor undiscovered flaws—raises equally important questions about the hidden security landscape in smaller-scale projects.

Additionally, the research contributes to ongoing debates about how the field defines and measures software vulnerabilities, addressing some of the construct validity problems that can cloud such investigations.