Meet Ondrej Sury, The Man Who Saved Internet From PHPocalypse

The world came close to a PHPocalypse on Tuesday (Oct 20) if it wasn't for a volunteer software engineer in Czechia. Roughly 70 per cent of websites in the world use PHP, a programming language that runs behind the scenes on websites, handling tasks like loading pages and processing logins. Earlier this week, cybersecurity researchers using a frontier model from OpenAI flagged two massive security vulnerabilities in PHP. If hackers exploited it, they could gain full control of servers, allowing them to copy or steal data or simply take websites offline.

The PHP Foundation, which maintains the programming language, had recently learned of the flaws, but details regarding the fix leaked on a forum before a patch was ready. Cloudflare CEO Matthew Prince detailed that the company saw thousands of exploit attempts in the 10 hours before the public announcement. That rose to tens of thousands within 45 minutes of it, and millions since.

"Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within 2 hours, and millions now," said Prince.

While the situation threatened to turn pear-shaped, Ondrej Sury, who maintains PHP software packages in his spare time for the last 20 years, decided to take the initiative. He quickly packaged the patch for the vulnerabilities, allowing websites around the world to apply the fix.

Also Read | 'Ashamed To Work': Google DeepMind Employees Resign Over Pentagon AI Contracts

'Here We Need'

In a conversation with The Atlantic, Sury said the PHP Project brought him in before the public release of the patch. However, after the leak, it was decided that the patch would be released a day early on Wednesday, instead of Thursday.

While social media users praised him for single-handedly helping millions on the internet, Sury downplayed his contribution, stating that it was simply his responsibility that he fulfilled.

"I've been doing this for a long time, over 20 years. A lot of the stuff that I do is automated. But the reason it was not crazy for me was that I actually don't have any system running PHP myself. So for me, it was like, sure, I feel a responsibility toward the users of the internet. It would be a crazy day for me if I was on a boat in the middle of the Adriatic Sea. That could happen. But I had time to prepare the packages," said Sury.

Quizzed if he panicked when the people at PHP Foundation approached him with the severity of the situation, Sury said having time to prepare packages helped avoid any panic. While the foundation provided the source code, Sury baked them into ready-to-install packages. If it wasn't for him, website owners would have spent hours trying to figure it out, allowing the hackers to enter the door.

"I'm in the stage of my life where I was like, This is bad. It needs to be fixed. But it doesn't cause panic, at least for me. It did cause panic for a lot of people. But you know, it was more like, We have a situation, it needs to be solved, and this is how we do it. And I have time to properly prepare," said Sury.

Apart from fixing the new versions, Sury back-engineered the fix for old versions of PHP going back 10 years, saving small businesses, schools and systems that would have been forgotten otherwise.

Following the security incident, donations increased significantly. Sury said contributions received over 24 hours were equivalent to roughly a year's worth of donations previously collected.

Sury said AI has sped up both attacks and defence, but the deeper problem is that infrastructure is taken for granted and underfunded. He said open-source work can feel like exploitation, and he wants the companies that benefit most to pay for it.