Ondřej Surý: the unpaid volunteer who rushed PHP’s fix to the web

Ondřej Surý lives in the Czech Republic and works as director of DNS engineering at Internet Systems Consortium (ISC), a nonprofit that helps maintain core internet infrastructure. DNS is the system that turns website names into the numeric addresses computers use.

His PHP work is a separate, volunteer job. For more than 20 years he has built and maintained PHP packages for Debian and Ubuntu, two of the most widely used versions of Linux on web servers. A package is a ready-made bundle that lets an administrator install or update software with one command instead of compiling it by hand.

His repository, known as DEB.SURY.ORG, offers newer PHP versions than the ones the operating systems ship with. Debian 12, for example, still comes with PHP 8.2 out of the box, so many site owners rely on his builds to stay current. In the repository’s own guidance, he says he does this entirely in his free time, and support comes from donations through Patreon and PayPal.

The crisis began when the PHP Foundation identified two serious bugs. One could leak memory contents. The other allowed unauthenticated remote code execution, meaning an attacker could run their own commands on a server without logging in. Security firm Wiz Research said the flaws affected nearly every version of PHP released in the past decade.

Details leaked earlier than planned, so the PHP project rushed out its fixes. Some government agencies and health organizations in Europe took services offline as a precaution while they waited.

The PHP Foundation said the flaws had been exposed by advances in AI, a sign of how quickly automated tools are now finding deep bugs in old code.

Having fixed source code isn’t the same as having a fix on your server. Most administrators don’t build PHP themselves. They wait for a package. Surý quickly turned the official patch into packages anyone on Debian or Ubuntu could install, which saved thousands of administrators from compiling software by hand in the middle of an emergency.

He went further, preparing back-ported fixes for older PHP versions, some close to ten years old. That matters because many small businesses, schools and charities can’t jump to the newest PHP overnight. Old plugins, in-house tools and outside suppliers tie them to older releases. Without those back-ports, they would have stayed exposed for longer.

Surý says much of the process is automated after two decades of practice. He also admits the timing was lucky: had he been out on a boat in the Adriatic that day, it would have been a very different story. He said he felt responsible for all the people relying on his work.

Surý is quick to share the credit. The fix itself came from the PHP project and the PHP Foundation, and he has pointed to the wider team of developers who worked on the patches. He has played down the hero label.

Still, the episode shows a familiar weak spot in open-source software. Huge numbers of companies, universities and public bodies depend on packages kept alive by a handful of volunteers. When it works, nobody notices. When one of those people is unavailable, patches slow down and the window for attackers stays open longer.

Support did arrive this time. Donations to Surý passed $10,000 within a few days, which he said was roughly a year’s worth of what he usually receives. He called the PHP flaws the most severe incident in years and warned that AI could make serious bugs like these appear more often.

The patches are out, but a fix only protects servers that install it. If you run a website, or pay someone to host one, take these steps:

1. Ask your host. Most shared hosting customers can’t update PHP themselves. Check that your provider has applied the security fixes.
2. Update to the newest patched release in the PHP branch you use, whether that comes from your operating system or from Surý’s repository.
3. Find older systems. If a site can’t move to a current PHP version, use the back-ported security builds rather than leaving it unpatched.
4. Check your logs. Review access logs and server settings for anything odd from before the patch went on.
5. Plan for end of life. Surý’s repository drops packages for releases soon after they reach end of life. Older Debian and Ubuntu versions are covered only by a paid long-term support service from Freexian, run together with DEB.SURY.ORG.