A volunteer software maintainer who helps distribute security fixes for PHP has emerged as a key figure in efforts to protect websites worldwide after two serious vulnerabilities triggered an urgent race to patch affected systems.
PHP security flaws trigger race to release fixes
After the patch was released, websites and organizations took systems offline to implement the fix, including government websites in Germany and Finland, as well as some hospital and school websites in Europe. The PHP Foundation, which maintains the programming language, had learned about the flaws before information about them was leaked online . The leak prompted developers to accelerate the release of a patch, bringing forward the timeline by a day. The vulnerabilities prompted a rapid response from the PHP project, software maintainers and website operators. Surý’s contribution involves preparing PHP source code into packages that administrators can install on servers. These packages make it easier to deploy updates across large numbers of machines without having to compile the software manually. Surý does not work for the PHP Foundation. He volunteers on the project alongside his full-time role as director of domain-name-system engineering at the nonprofit Internet Systems Consortium. Following the security incident, donations increased significantly.
He reported thousands of attempts in the 10 hours before the flaws were announced, followed by tens of thousands within 45 minutes, hundreds of thousands within two hours and millions subsequently. He told The Atlantic that he had been working in this area for more than 20 years and had time to prepare the packages before the fix was released. Surý said contributions received over 24 hours were equivalent to roughly a year’s worth of donations previously collected.
Cloudflare chief executive Matthew Prince said attempts to exploit the vulnerabilities rose sharply around the public disclosure. he said distributing ready-to-install packages made the process faster and easier for administrators Although other sources could provide the PHP code. His work has received donations, but he said the contributions he normally receives are modest.
Surý calls for better support for open-source software
Ondřej Surý, who lives in Czechia, helps maintain and automate software packages for PHP, a programming language used by roughly 70% of websites, according to The Atlantic . He argued that businesses benefiting from open-source software should provide better financial support to the people maintaining it, warning that the current system could become unsustainable if volunteers lost motivation. He also said contingency plans were being discussed with Raphaël Hertzog of software company Freexian so that others could take over if he became unavailable. Because not every website had installed the updates, surý warned that the risk had not disappeared.
The incident highlighted concerns about how much of the internet depends on a relatively small number of people maintaining critical open-source software . Unpatched systems could still face vandalism, disruption, botnet infections or cryptocurrency-mining abuse. He also rejected claims that older PHP versions were permanently impossible to patch, saying updates remained possible if operators took the necessary steps. The incident has renewed questions about whether companies and organizations invest enough in the infrastructure they rely on. For ordinary internet users, Surý recommended relying on cybersecurity experts during such incidents. He described the episode as another warning that critical digital infrastructure cannot be taken for granted.
Surý said artificial intelligence tools were accelerating the discovery of vulnerabilities, but defenders could also use large language models to identify security weaknesses.
The vulnerabilities, disclosed earlier this week, could allow attackers to execute their own code on affected servers, potentially enabling them to steal data, disrupt websites or use compromised systems for criminal activity.
