The PHP developer who became the unsung hero of the internet

For over two decades, Ondřej Surý has played a crucial yet understated role in maintaining the security of websites globally, primarily in his free time. He is a voluntary maintainer of software for two widely-used Linux distributions, Debian and Ubuntu, which are commonly deployed on web servers.

Surý’s primary responsibility involves ensuring that these systems are updated with the latest version of PHP, a programming language that serves as the backbone for a vast number of websites. Recently, he found himself inundated with work after two significant cybersecurity vulnerabilities in PHP were discovered with the assistance of artificial intelligence. In response, the PHP Foundation quickly issued patches to address these issues.

However, many users lack the technical expertise to implement these updates on their systems. Recognizing this challenge, Surý immediately set aside his regular tasks to convert the patches into user-friendly packages that could be installed with minimal technical knowledge. "The feeling is like I am responsible for all these people and I can't fail them," he shared in an interview with BBC News.

The security flaws in PHP triggered a global rush to install the necessary updates, as concerns grew about potential exploitation by cybercriminals. Surý is among a limited group of developers who play a vital role in making these updates accessible to users. Despite the critical nature of his contributions to internet security, this work is not his primary occupation. He serves as the director of DNS engineering at the Internet Systems Consortium, a non-profit organization based in the United States.

In his spare time, Surý has dedicated himself to maintaining PHP software packages for Debian and Ubuntu, transforming source code from the PHP project into easily installable packages for website operators. When asked about being labeled as one of the individuals who "saved the internet," he responded with humility. "It's kind of fulfilling because I sense my work has a purpose," he remarked. "At the same time, I feel that not enough credit has been given to other people who have been part of this, like the PHP project people."

Surý acknowledged the pressure that accompanies his role. He had received prior notification of the vulnerabilities from the PHP project, but when details of these weaknesses were leaked, the timeline for releasing the fixes was accelerated, increasing the urgency of his work. "I became aware that this is quite severe and I don't have that much time to prepare the packaging of the PHP that I provide to people," he explained. Despite the time constraints, he expressed confidence in his skills and preparation to meet the challenge.

Other developers across the globe were also engaged in ensuring the swift distribution of the patches, underscoring how much of the internet's foundational infrastructure relies on the dedication of individuals like Surý. In the wake of this recent crisis, Surý reported receiving an overwhelming response from users who depend on his software packages, noting that he received over $10,000 (£7,470) in donations within just a few days. "This week is basically about a year's worth of contributions that I got before," he noted.

Surý called on major technology companies to take greater responsibility for the open-source software they utilize. "I think they should be more responsible," he stated. "If you just take and don't give back, then it will backfire." He is also contemplating the future of the software packages he maintains, considering what would happen if he could no longer oversee them. While colleagues at Freexian could potentially step in, he acknowledged they might not yet possess the same level of experience.

Concerned about the implications of artificial intelligence in cybersecurity, Surý remarked that the recent vulnerabilities might not be isolated incidents. "I think this was the most severe incident in years, but because AI capabilities are improving in cybersecurity, this might not be the last," he cautioned. "People should be prepared to act quickly more often, as such incidents could occur again in the near future."