For over two decades, Ondřej Surý has been a pivotal figure in maintaining the secure operation of websites globally, dedicating much of his free time to this cause. He voluntarily oversees software for two widely used Linux versions, which are essential for web servers. This role typically involves updating these systems with the latest versions of PHP, a programming language that supports a significant portion of the internet.
This week, Surý found himself particularly busy as AI-assisted detection uncovered two critical security flaws in PHP. In response, the PHP Foundation released necessary fixes. However, many users may struggle with the installation process. To alleviate this, Surý stepped in to create easily installable packages for the updates, all at no cost. “The feeling is like I am responsible for all these people and I can’t fail them,” he shared with BBC News.
The recent vulnerabilities in PHP triggered a worldwide urgency to implement security updates due to concerns about potential cyberattacks exploiting these weaknesses. Surý is among a select group of developers who ensure these updates are accessible. Despite the enormity of the task of securing the internet, this isn’t his primary profession; he serves as the director of DNS engineering at the Internet Systems Consortium, a nonprofit organization based in the US.
In his spare time, Surý has dedicated himself to maintaining PHP software packages for Debian and Ubuntu Linux versions, transforming the PHP project’s source code into user-friendly packages for website operators. When asked about being labeled as someone who helped “save the internet,” he humbly acknowledged the recognition while also emphasizing the contributions of others involved, particularly those in the PHP project.
Surý noted the significant support he received this week from users reliant on his packages, revealing that donations surpassed $10,000 (£7,470) in just a few days, a stark contrast to his usual annual contributions. He voiced a concern that major technology firms should take greater responsibility in supporting the open-source software they utilize, stating, “If you just take and don’t give back then it will backfire.”
He also contemplated the potential implications if he could no longer maintain the software, suggesting that colleagues at Freexian could step in, though they might lack his extensive experience. Surý expressed worries that AI could be accelerating the identification of security vulnerabilities, benefiting both cybercriminals and those defending against them. “I think this is was the most severe incident in years, but with AI capabilities improving, this might not be an isolated case,” he warned. He urged that people should be prepared for quicker responses to such incidents in the future.
