The headline is catchy, but the details matter. This piece covers what the count measures, which Windows-facing projects are affected, and what administrators can do about it.
What the count actually measures
The number is narrower than "11 projects have only two maintainers."
- Activity, not governance. The authors took each project's public history from 7 October 2025 to 7 October 2026. They excluded merges and bots. A person counted only with ten or more changes. They warn that a change's author is not always the maintainer, and that some projects publish their history as a copy of another system.
- A lower bound on devices. The authors counted a project on a platform only when they could see it there. For Windows they used Microsoft's announcement for curl and the code inside Edge. Macs, iPads, servers, cars and TVs are left out. They cite Windows at 1.6 billion monthly users (Microsoft, 2026). That is platform scale, not a count of PCs containing each project.
- "No public grant" is narrow. It means no funding found through the Sovereign Tech Agency, Alpha-Omega, Open Collective or GitHub Sponsors. It does not mean nobody has ever paid these maintainers. The authors say so themselves.
A low commit count is not a vulnerability. It describes concentration of effort, which is a continuity risk. Treat it as a flag for your risk register, not as proof that a project is unsafe.
The Windows-relevant projects
curl. According to the report, curl has shipped with Windows since 2018. Eleven people did regular work on curl this year, with Viktor Szakats making the most changes, then Daniel Stenberg, then Stefan Eissing. Stenberg works on it full time because companies pay for support. The project takes in about $89,700 a year through Open Collective, and Germany's public fund for open source paid €195,000 for work on it. Curl shows that funding and a bigger team can coexist.
SQLite. The report says four people changed SQLite in the past year. It says the database is in every copy of Windows 10 and 11 and in every major browser. The project's own estimate is over a trillion databases in use, so treat that as the project's figure, not an independent count. The team pays for the work by selling support through founder D. Richard Hipp's company. Tom's Hardware notes that the team removed its names and photos from the project page, citing safety concerns.
libjpeg-turbo. Per the report, this library opens JPEGs in Chrome and Edge as well as on Android. The maintainer, known as DRC, runs it as a small business sustained by patronage and funded development. He wrote 98 percent of the changes this year. At one point he said general funding covered about 8–10 hours of labor a month. That is a past snapshot, not a current budget.
HarfBuzz. This text-shaping library is used by Android, Chrome, Firefox, Edge, the Kindle and Figma. In Hindi, Arabic and Tamil, letters change shape depending on their neighbours, so without shaping, words fall apart. Behdad Esfahbod wrote 85 percent of the changes, with five others doing regular work. A text-rendering library is easy to forget until it breaks.
zlib and libxml2. The report puts zlib inside PNG images, Git, Android, iPhones and Chrome. Two people did most of the work this year, and it found no public funding. For libxml2, Nick Wellnhofer stepped down in 2025. The report says new maintainers were added about twelve hours after he removed himself from the maintainers list in December. That is a handoff that worked.
What history does and doesn't show
Tom's Hardware lists Heartbleed, Shellshock, ImageMagick, Log4Shell, libwebp and the xz backdoor as past incidents. They show how far a single flaw can reach. They do not show that underfunding caused each one.
- Shellshock. Data Drop traces the bash line behind it to 5 August 1989. It went public on 24 September 2014 after Stéphane Chazelas reported it. The lesson is that old code can hide old bugs. It is not a staffing story.
- xz. This is the sharpest case. The report describes a lone maintainer under pressure who gave extra access to a contributor called Jia Tan. Two versions released in February 2024 carried a backdoor. xz has a single regular contributor, Lasse Collin, who wrote 97 percent of its changes in 2025. The analysis found no new funding after the 2024 backdoor. The backdoor needed a patient attacker who gained trust. Still, an overstretched maintainer who is short on help is exactly the opening such social engineering exploits. The report credits Microsoft engineer Andres Freund with finding the backdoor on 29 March 2024.
- Heartbleed. The report quotes the OpenSSL foundation's president saying donations ran about $2,000 a year in April 2014. After the disclosure, the Linux Foundation raised $5.4 million from technology companies. OpenSSL went from six regular contributors in 2013 to fourteen in 2014, and the report says it has 32 in 2026. The pattern is that money arrives after a disaster.
The funding picture
The Sovereign Tech Agency has funded about ninety open-source projects since 2022, the report says. The awards it lists are:
| Project | Award found |
|---|---|
| Log4j | €596,160 |
| FFmpeg | €437,930 |
| OpenSSL | €405,888 |
| OpenSSH | €200,000 |
| curl | €195,000 |
It found no public grant for the time zone database, SQLite, zlib, libjpeg-turbo, HarfBuzz, xz, bash or nghttp2. Money does sometimes follow attention. In February 2026, sudo's maintainer publicly sought a sponsor. After The Register covered it, the Open Collective budget grew to about $61,700 a year with 30 GitHub sponsors.
One more caveat is that the report is a snapshot of 23 projects the authors chose. It is not a census of open source, and the authors invite corrections.
What admins and developers can do
This part is general industry practice, not a finding of the report.
- Inventory your dependencies. A software bill of materials for in-house software shows which small projects you rely on. Many vendors can now supply one for their products.
- Map concentration risk. For each critical dependency, check how many people are active, whether a successor is named, and how quickly security fixes ship.
- Watch the update channels. curl, SQLite, zlib and libxml2 reach Windows environments through bundled copies in vendor and open-source software, not only through Windows Update. Track advisories for the components you ship or run.
- Fund what you depend on. Sponsorship, support contracts or staff time are cheaper than an emergency. As Tom's Hardware argues, in an era when AI tools find exploitable bugs fast, donations can also be seen as an investment.
- Plan for handoffs. The report shows that succession plans work. Paul Eggert named a backup for the time zone file in 2020, and libxml2 found new maintainers within a day.
Bottom line
The report's own data say the old xkcd joke is partly true: some critical code has one or two people behind it, and public funding is uneven. It does not say any named project is about to fail, or that fewer maintainers means less secure code. For Windows and enterprise teams, it is a prompt to find out which small projects sit under your stack and to treat their upkeep as part of your own security budget.