The Quiet Backbone of Digital Security
Ondrej Surý, a 49-year-old Czech engineer, recently helped save millions of websites by packaging patched PHP code for older versions during a critical security crisis. His work highlights a shifting dynamic in internet infrastructure, where individual volunteers are increasingly essential to managing the rapid discovery of vulnerabilities by artificial intelligence.
Surý’s intervention was not about performing a task that was impossible for others, but about doing it with a speed and ease that only deep expertise allows. He has been the main Debian packager for PHP and other packages under the DEB.SURY.ORG name for a long time, making the maintenance of this software his day-to-day work. When two U.S. security firms discovered critical flaws in PHP in August 2026, Surý was able to adapt the fixes for older versions of the language quickly. This prevented a potential collapse of digital services that rely heavily on that specific codebase.
Why One Engineer’s Effort Mattered
To understand the scale of Surý’s contribution, it helps to look at the reach of the software he maintains. PHP is the programming language used on 70% of the world’s websites. The vulnerabilities discovered in August 2026, known as PHP2Shell, affected versions ranging from 5.4 to 8.5. These flaws allowed remote code execution, meaning an attacker could gain control of the server hosting the website. The potential consequences were severe, including the alteration of sites, theft of customer data, and access to other connected computers.
The PHP maintainers released patched versions for PHP 8.2, 8.3, 8.4, and 8.5. However, they did not release official updated binaries for older versions such as 7.4, 8.0, and 8.1, which were considered end-of-life. Many organizations, including government portals in the Netherlands, Denmark, Finland, and France, as well as major platforms like the Wikimedia Foundation and the Internet Archive, took their websites offline as a precaution. Without Surý’s work, administrators of sites running those older versions would have had to compile the software themselves from source code, a process that requires significant time and technical skill. Surý prepared installable packages that allowed server administrators to automate deployments, effectively bridging the gap between the official patches and the older systems still in use.
How AI Changed the Speed of Discovery
The PHP2Shell vulnerabilities were discovered with the help of artificial intelligence. Ryan Austin, a researcher at the California-based security firm Calif, used OpenAI’s GPT-5.6 Sol model as part of the “Patch the Planet” project to identify one of the flaws. Simultaneously, researchers at Wiz, a subsidiary of Alphabet Inc., used large language models including Gemini 4 Argon and GPT-5.6 Sol, along with their own tool Wiz Atlas, to find the issues independently. This marks a shift in how security flaws are found. AI tools are accelerating the process of vulnerability research, which has historically been tedious and slow.
Michael Schwartz, chief technology officer at cybersecurity firm Censys, describes this dynamic as an arms race. He notes that while AI speeds up the discovery of bugs, it does so for both defenders and attackers. The result is an increased workload for the volunteers who maintain the software. A graph created by a programmer known as 0xosprey, using AI assistance, tracks the rapid growth of vulnerabilities recorded in the official Common Vulnerabilities and Exposures (CVE) database. This trend illustrates why the role of individual maintainers has become more critical, not less.
The Reliance on Volunteer Goodwill
The internet infrastructure relies heavily on open-source software, which is maintained by volunteers rather than corporate employees. Courtney Miller, a professor at George Washington University, confirms that this movement is sustained by individuals who often work on projects in their spare time. Many companies benefit from this free software, but the maintenance is led by people who may change jobs, lose interest, or simply run out of time. This creates a peculiar risk in the modern digital landscape. If a key maintainer steps away, the project can become vulnerable or abandoned.
Surý himself acknowledges this fragility. He notes that when he started with free software, it felt fresh and exciting, but he is unsure if new generations will view it the same way. He observes that the internet has sped up and that the presence of AI might overwhelm young people with too many choices. He believes that maintaining open-source projects requires a specific mindset: a desire to do something for others. Daniel Stenberg, the Swedish developer who created and maintains curl, a data-transfer tool found on billions of devices, points out that the lack of foresight in companies that exploit open-source software without contributing back is what causes these crises to repeat.
Challenges for the Future
The situation with PHP highlights a broader issue in technology. The PHP Foundation, which maintains the language, has only 13 full- and part-time employees and relies on financial contributions. In contrast, the AI research credited with helping discover the vulnerability has received billions in investment. This disparity in resources creates a challenge for maintaining security. Surý argues that companies making money from commercial products that rely on open-source software should be held accountable and help fund these projects. He believes that the current norm of accepting buggy software is unacceptable.
Jesús María González Barahona, a professor of Telematics Engineering at Madrid’s Rey Juan Carlos University, predicts that similar crises will occur. He states that the probability of a large-scale vulnerability in widely used components is not zero. He calls for more resources to be devoted to these projects, both from companies and public funds. The internet is a complex network of small parts, each vital in its own way. As AI continues to accelerate the pace of both attacks and defenses, the need for skilled individuals willing to maintain the underlying infrastructure will only grow. Surý’s work demonstrates that individual expertise can mitigate systemic risks, but the sustainability of the entire system depends on a broader shift in how society values and supports the people who keep the digital world running.
Sources
- Ondrej Surý, the man who saved the internet: ‘You have to want to do something for others’
- PHP2Shell
Photo: Wikideas1 (CC0)
