A volunteer software maintainer who helps distribute security fixes for PHP has emerged as a key figure in efforts to protect websites worldwide after two serious vulnerabilities triggered an urgent race to patch affected systems.
Ondřej Surý, who lives in Czechia, helps maintain and automate software packages for PHP, a programming language used by roughly 70% of websites, according to The Atlantic. The vulnerabilities, disclosed earlier this week, could allow attackers to execute their own code on affected servers, potentially enabling them to steal data, disrupt websites or use compromised systems for criminal activity.
The PHP Foundation, which maintains the programming language, had learned about the flaws before information about them was leaked online. The leak prompted developers to accelerate the release of a patch, bringing forward the timeline by a day.
Deep Dive
What does Ondřej Surý do to help fix PHP security flaws?
Why were some websites taken offline after the PHP vulnerabilities were disclosed?
What should website operators do if their servers are affected by the PHP flaws?
The incident highlighted concerns about how much of the internet depends on a relatively small number of people maintaining critical open-source software.
Also Read: US issues travel alert ahead of Steelers vs Saints Paris NFL game as protests rock France
PHP security flaws trigger race to release fixes
{{/usCountry}}Also Read: US issues travel alert ahead of Steelers vs Saints Paris NFL game as protests rock France
PHP security flaws trigger race to release fixes
{{/usCountry}}The vulnerabilities prompted a rapid response from the PHP project, software maintainers and website operators. After the patch was released, websites and organizations took systems offline to implement the fix, including government websites in Germany and Finland, as well as some hospital and school websites in Europe.
Cloudflare chief executive Matthew Prince said attempts to exploit the vulnerabilities rose sharply around the public disclosure. He reported thousands of attempts in the 10 hours before the flaws were announced, followed by tens of thousands within 45 minutes, hundreds of thousands within two hours and millions subsequently.
Surý’s contribution involves preparing PHP source code into packages that administrators can install on servers. These packages make it easier to deploy updates across large numbers of machines without having to compile the software manually.
He told The Atlantic that he had been working in this area for more than 20 years and had time to prepare the packages before the fix was released. Although other sources could provide the PHP code, he said distributing ready-to-install packages made the process faster and easier for administrators.
Volunteer maintainers raise concerns about internet security
Surý does not work for the PHP Foundation. He volunteers on the project alongside his full-time role as director of domain-name-system engineering at the nonprofit Internet Systems Consortium. His work has received donations, but he said the contributions he normally receives are modest.
Following the security incident, donations increased significantly. Surý said contributions received over 24 hours were equivalent to roughly a year’s worth of donations previously collected.
He also said contingency plans were being discussed with Raphaël Hertzog of software company Freexian so that others could take over if he became unavailable.
Surý warned that the risk had not disappeared because not every website had installed the updates. Unpatched systems could still face vandalism, disruption, botnet infections or cryptocurrency-mining abuse. He also rejected claims that older PHP versions were permanently impossible to patch, saying updates remained possible if operators took the necessary steps.
Surý calls for better support for open-source software
The incident has renewed questions about whether companies and organizations invest enough in the infrastructure they rely on. Surý said artificial intelligence tools were accelerating the discovery of vulnerabilities, but defenders could also use large language models to identify security weaknesses.
He argued that businesses benefiting from open-source software should provide better financial support to the people maintaining it, warning that the current system could become unsustainable if volunteers lost motivation.
For ordinary internet users, Surý recommended relying on cybersecurity experts during such incidents. He described the episode as another warning that critical digital infrastructure cannot be taken for granted.