Far from the attention of most people who browse the web, a quiet arrangement holds much of the internet together: volunteers who keep the software running the world's servers safe. This week one of them, Ondřej Surý, who has spent more than two decades maintaining PHP packages for Debian and Ubuntu in his spare time, was called upon when serious flaws in PHP, uncovered with the help of artificial intelligence, threatened sites everywhere. It is a reminder that the security of shared digital infrastructure often rests on a few people giving their time freely, and on whether the wider world is
The volunteer PHP packager quietly keeping the web secure, and the AI-driven scramble that tested him
"I am responsible for all these people and I can't fail them."
Mark
Why does one volunteer's week make the news?
Mimi
Because the PHP fixes only help people who can install them. Surý turned the source code into Debian and Ubuntu packages, so ordinary website operators could patch without expertise.
Mark
And he does this unpaid?
Mimi
Yes, for more than twenty years, around a day job as director of DNS engineering at Internet Systems Consortium.
Luke
Let's be careful about the AI part. The report says two flaws were found with AI help, but it doesn't say which tools, who used them, or how much the AI contributed.
Mimi
Fair. What's sourced is that AI assisted the identification. Surý's own view is that AI is getting better at cyber security work and this may not be isolated.
Mark
What changed his timeline?
Mimi
He'd had advance warning from the PHP project, but details leaked online and the release was brought forward.
Luke
Also, the phrase "saved the internet" came from people online. Surý himself deflected it and credited the PHP project people.
Mark
What about the donations?
Mimi
More than $10,000 in a few days, which he says is about a year's worth of earlier contributions. That's his figure.
Luke
And the succession question is unresolved. Freexian colleagues could take over, but he says they lack his experience. How exposed the system really is, the article doesn't quantify.
The Pulse
- Two serious PHP flaws, reportedly found with AI assistance, sent an international scramble through the teams responsible for websites.
- Leaked details forced the planned release forward, leaving Surý with far less time than he had prepared for.
- Surý turned raw source fixes into simple Debian and Ubuntu packages, working unpaid to get them into ordinary operators' hands.
- Donations of over $10,000 arrived within days, but the episode has exposed how much depends on a handful of unpaid maintainers.
Far from the attention of most people who browse the web, a quiet arrangement holds much of the internet together: volunteers who keep the software running the world's servers safe. This week one of them, Ondřej Surý, who has spent more than two decades maintaining PHP packages for Debian and Ubuntu in his spare time, was called upon when serious flaws in PHP, uncovered with the help of artificial intelligence, threatened sites everywhere. It is a reminder that the security of shared digital infrastructure often rests on a few people giving their time freely, and on whether the wider world is willing to support them as the pace of discovery quickens.
For more than twenty years, Ondřej Surý has kept the PHP software that runs on web servers up to date for Debian and Ubuntu, two widely used versions of Linux. He does it voluntarily, in his spare time. This week that quiet work became urgent.
PHP underpins a large share of the world's websites, and two major security flaws were identified in it with the help of AI. The PHP Foundation released fixes, but as source code they are difficult for most website operators to install. Surý, without payment, set aside what he was doing and turned the fixes into packages anyone could install without specialist knowledge. The flaws set off an international scramble to patch systems before criminals could exploit them.
By day, Surý is director of DNS engineering at Internet Systems Consortium, a US non-profit. He had received advance warning from the PHP project, but when details of the weaknesses leaked online, the release was brought forward. He said he understood the severity and had little time to prepare, yet he trusted his experience to finish the job. "The feeling is like I am responsible for all these people and I can't fail them," he said.
When some praised him for helping to "save the internet," he was modest, pointing to others such as the PHP project's own developers. Support came in too: more than $10,000 in donations within a few days, roughly a year's worth of his usual contributions. He argued that large technology companies must give back to the open source software they depend on. He also acknowledged that if he stopped, colleagues at Freexian could take over, but without his accumulated experience, and that much of the responsibility rests with him.
Surý believes this was the most severe incident in years and may not be the last. He fears AI will speed up the discovery of vulnerabilities for criminals and defenders alike, and that people will need to move this fast more often.
For more than twenty years, Ondřej Surý has done a job most internet users have never heard of: he keeps the PHP software that runs on web servers up to date for two of the most widely used versions of Linux, Debian and Ubuntu. He does it voluntarily, in his spare time. This week, that spare-time work became urgent.
PHP is a programming language that underpins a significant share of the world's websites. Two major security flaws were identified in it, with the help of AI, and the PHP Foundation released fixes. But a fix released as source code is not something every website operator can easily use. Many people would struggle to install it on their systems. So Surý, without payment, dropped what he was doing and turned the fixes into packages that can be installed without specialist expertise.
The vulnerabilities set off an international scramble to apply security updates, amid fears that cyber criminals could exploit the gaps before systems were patched. Surý is one of a small number of developers whose work makes those updates available to ordinary operators. Other developers around the world were also working to get the patches distributed.
His day job is director of DNS engineering at Internet Systems Consortium, a US non-profit organisation. The PHP packaging is separate: he takes the source code released by the PHP project and builds the Debian and Ubuntu packages that website operators install on their servers.
Surý had been given advance warning about the flaws by the PHP project. Then information about the weaknesses leaked online, and the planned release was brought forward. He told BBC News he realised the problem was severe and that he did not have much time to prepare his packaging. He said he was nonetheless confident his experience and preparation would let him finish the work. "The feeling is like I am responsible for all these people and I can't fail them," he said.
When some online described him as one of the people who helped "save the internet" this week, he was modest. He said the recognition was fulfilling because it told him his work had a purpose, but that not enough credit had gone to others involved, such as the people on the PHP project itself.
The week also brought a wave of support from people who rely on his packages. He said he received more than $10,000 (£7,470) in donations within a few days, roughly a year's worth of the contributions he had received before. He argued that major technology companies should take more responsibility for supporting the open source software they depend on. "If you just take and don't give back then it will backfire," he said.
He has also thought about what would happen if he could no longer do the work. Colleagues at the software company Freexian could take over, he said, but they do not yet have the same accumulated experience. Asked by the BBC whether much of the responsibility ultimately rests with him, he answered that it was pretty much true.
Looking ahead, Surý believes this was the most severe incident in years, but not necessarily an isolated one. He is concerned that AI is accelerating the discovery of security vulnerabilities, helping both criminals and those trying to stop them, and he said people should be prepared to act this quickly more often in the near future.
Notable Quotes
If you just take and don't give back then it will backfire.— Ondřej Surý, on big tech and open source support
This might not be an isolated incident, and people should be prepared to act this quickly more often.— Ondřej Surý (lightly condensed)
Want the full story?
Read the original at BBC ↗