The man behind the 'Internet rescue' from the PHP disaster
"I once told some people, that the world has one expert who alone is responsible for most of the worldwide distribution of PHP. And if anything happens to this person, it's over. It could all be in trouble," software developer Ian Landsman wrote on Twitter, referring to Ondrej Sury, a volunteer developer of PHP - the programming language used for about 70% of websites today.
The Internet had a bad day when two serious vulnerabilities related to PHP, called PHP2Shell, were made public on October 21. If successfully exploited by hackers, many experts believe that the Internet could collapse. But this did not happen. According to The Atlantic and BBC, major credit belongs to Sury.
Ondrej Sury lives in the Czech Republic, does not work for the PHP Foundation - the foundation behind PHP - but is a volunteer involved in maintaining this programming language. When the PHP2Shell vulnerability appeared, he was considered the unsung hero who helped quickly deploy the patch within 48 hours, allowing countless websites and organizations to fix the vulnerability.
"Ondrej saved the Internet today," a user on the PHP Subreddit forum wrote after the vulnerability and patch were made public on October 21.
Race against time
Sury is the Director of DNS Engineering at the non-profit Internet Systems Consortium, but for more than 20 years, he has spent his free time maintaining PHP software packages for the two Linux operating systems Debian and Ubuntu as a volunteer. His work includes receiving source code from the PHP project, packaging it into a compatible version for website administrators to easily install on the server. This role made Sury important in the PHP2Shell incident.
In fact, two PHP vulnerabilities were previously discovered by two cybersecurity companies, Calif Research and Wiz, and cooperated with the PHP Foundation to patch them. The patch release date is set for October 22. However, the inevitable happened: vulnerability information suddenly appeared on Hacker News on October 21.
Speaking to the BBC, Ondrej Sury said that due to information being leaked online, the patch release plan had to be accelerated, making everything rushed. "I realize the situation is serious and there is not much time left to prepare a PHP update package for the community," Sury said, adding that the two vulnerabilities have created an "international race" to install security updates to avoid exploitation.
Even though he was under time pressure, Sury believed that previous experience and preparation helped him complete the job. "I have been doing this for more than 20 years, most of the processes are automated. I do not operate any system that uses PHP. However, I still have a responsibility to Internet users," he said. "Things could have gotten complicated if I was sailing in the middle of the Adriatic Sea at that time. That scenario is entirely possible, but luckily I had time to prepare the software packages."
In addition to fixing bugs for the new version, Sury seeks to fix vulnerabilities in PHP versions released 10 years ago, helping small businesses, schools and legacy systems continue to operate instead of being left behind.
After the security incident, the amount of money donated to his work increased sharply. Sury said within 24 hours, he received $10,000. "Basically, this is the total amount I receive for the whole year," he shared.
He believes that large technology companies need to be more responsible in supporting the open source software they are using, including PHP. "If you only receive without giving, it will be counterproductive," Sury said.
With AI, Sury warns the technology is accelerating the process of detecting security vulnerabilities, "giving both hackers and defenders an advantage." According to him, the recent incident may not be an isolated case, forcing developers to prepare to respond faster in the future.
When asked how it felt to be described as one of the people who helped "save the Internet", he replied: "I find my work meaningful and satisfying. But many other volunteers also play a big role, without being adequately recognized."
This expert is also concerned that maintaining software packages will be difficult if he cannot continue in the future. Other volunteers can take over, but have not yet accumulated enough experience, and recognize that most of the responsibility still lies with them.
The two PHP2Shell vulnerabilities, if exploited, would allow an attacker to remotely execute code on an unpatched system, creating the risk of data theft or server takeover. The incident raises concerns about the possibility that hackers can use AI to find and exploit system weaknesses faster. With a high level of severity, Guardian and Business Insider call this "dark October" for cybersecurity.