Lack of staff and funding likely led to the recent PHP security snafu; project has only one full-time employee, but that’s just the tip of the iceberg