Ondřej Surý, a long‑time volunteer maintainer for the Debian and Ubuntu Linux distributions, spent the past week turning critical security fixes for the PHP programming language into ready‑to‑install packages, allowing thousands of website operators to patch their servers without specialist knowledge.
Volunteer work keeps PHP secure
For more than two decades Surý has been responsible for converting the upstream PHP source code into binary packages that can be deployed on Debian and Ubuntu systems. Although the work is essential for the stability of a large portion of the web, it is performed in his spare time; his full‑time occupation is director of DNS engineering at the Internet Systems Consortium, a U.S. non‑profit that provides core internet infrastructure.
Earlier this month two severe vulnerabilities were discovered in PHP with the assistance of artificial‑intelligence tools. The PHP Foundation promptly issued patches, but many administrators found the process of rebuilding and installing the updated PHP binaries daunting. Surý stepped in, repackaging the patches for the two Linux distributions and publishing the new packages so that they could be installed with a single command.
“The feeling is like I am responsible for all these people and I can’t fail them,” Surý told BBC News, describing the pressure he felt as the global community raced to close the gaps before malicious actors could exploit them.
He received advance notice of the flaws from the PHP project, yet the leak of details online forced the foundation to accelerate the release schedule. “I got aware that this is quite severe and I don’t have that much time to prepare the packaging of the PHP that I provide to people,” he said, adding that his years of experience gave him confidence to meet the tight deadline.
Surý was not alone in the effort. Developers around the world coordinated to ensure the patches were distributed quickly, underscoring how much of the internet’s essential infrastructure relies on a small network of dedicated open‑source contributors.
Funding surge and future concerns
The emergency prompted an outpouring of gratitude from users of his packages. Within a few days Surý reported receiving more than $10,000 (about £7,470) in donations – an amount he described as roughly a year’s worth of contributions in a single week.
He used the moment to call on major technology companies to assume greater responsibility for the open‑source projects they depend on. “If you just take and don’t give back then it will backfire,” he warned.
Looking ahead, Surý acknowledged the risk of becoming a single point of failure. He mentioned that colleagues at the software firm Freexian could eventually take over maintenance, but they lack the accumulated expertise he has built over twenty years. “Yes, that’s pretty much true,” he replied when asked whether the burden ultimately rested on his shoulders.
Surý also expressed concern that AI‑driven tools are accelerating the discovery of security flaws, benefiting both attackers and defenders. “This was the most severe incident in years, but because AI capabilities are getting better in cybersecurity, this might not be an isolated incident,” he said. “People should be prepared to act this quickly more often because incidents like this might happen in the near future.”
His modest assessment of the week’s events reflected both pride in a job well done and a desire for broader recognition of the many contributors behind the PHP project itself. “It’s kind of fulfilling because I sense my work has a purpose,” he noted, while also stressing that credit should be shared with the upstream developers.
Helene Elliott is the Lead Science & Space Reporter at News Raise. She reports on aerospace missions, astrophysics discoveries, quantum research, and environmental technology.
