A PHP high-severity vulnerability triggers global panic; volunteer Ondřej Surý single-handedly completes the critical packaging work

On October 21, PHP, the programming language that about seventy percent of the world's websites depend on, was revealed to have two remote code execution vulnerabilities with a CVSS score of 9.2. Government websites in various countries went offline, hospitals and schools carried out emergency maintenance, and Cloudflare observed hundreds of thousands of attack attempts within two hours. And before the patch could be installed on millions of servers, a volunteer living in the Czech Republic took the most critical step.

1 A crisis detonated early, buried atop structural failure

Over the past month, public statements from cybersecurity experts have carried a rare sense of panic. Some warned that AI could detonate a "black swan" event; some were stunned by the large batch of vulnerabilities that have suddenly emerged in recent days; and others worried that agents and large language models are showing the ability to discover and exploit unknown vulnerabilities.

These voices, at the milder end, are familiar security advice—update software promptly, enable two-factor authentication; at the more severe end, they talk vaguely online about AI-driven attacks, sigh that "the internet used to be wonderful," and even betray a doomsday-survivalist panic: urging people to withdraw cash from banks, disconnect from the network, stockpile shelf-stable food and drinking water, convert money into gold and cash, and buy a hand-cranked emergency radio.

Matthew Green, a professor at Johns Hopkins University and one of the world's most respected cryptographers, posted: "We are in that part of the movie: throw everything you can find at the zombies, just to slow them down." He also wrote: "More and more people are discovering that the entire internet is like a pile of dry kindling, and the only reason it hasn't caught fire is that the teenagers haven't found the matches yet."

When these posts appeared, the people using AI tools to find the PHP vulnerabilities had not yet made their move. PHP is the programming language that keeps many parts of the internet running. In recent days, major vulnerabilities and security issues have surfaced one after another, involving the Indian website security certificate provider eMudhra, the PHP alternative Node.js, the software development platform GitLab, the cloud service provider Railway, and the coding agent platform OpenCode, among other companies and services, with several more companies and services also affected. However, the most closely watched is still the PHP vulnerability, which researchers call PHP2Shell. Researchers at Wiz, Calif and OpenAI discovered these vulnerabilities with the help of AI.

Matthew Prince, chief executive of Cloudflare, the company he leads can observe the overall operation of the internet on a large scale. He wrote online: "In the 10 hours before PHP2Shell was publicly disclosed, the Cloudflare network observed thousands of exploit attempts. Within 45 minutes of the disclosure, the number of attempts rose to tens of thousands; within two hours it reached hundreds of thousands, and now there have been millions."

Behind these numbers is a crisis detonated early. The PHP security team had originally planned to release fixes for two severe vulnerabilities the next day, both of which allow unauthenticated attackers to execute arbitrary code on the server—what the security world calls "the worst kind": no password needed, no special privileges needed, and attackers can take over the server directly.

But information about the vulnerabilities leaked before the patch was released, and a proof-of-concept attack demonstration video began circulating online—though at that time no technical details had yet leaked. The demonstration came from the software supply chain security company Chainguard.

According to its CEO, they used the company's AI Harness and a frontier model to discover the same batch of memory corruption vulnerabilities, with the prompt being nothing more than a "basic instruction: 'Find severe vulnerabilities in PHP.'" Chainguard then began working with the PHP maintainers, confirmed that some of the issues it had found matched the vulnerability reports, and helped test the patches. "These patches are very complex—this is by no means a simple vulnerability, and they really did spend several months to produce truly usable patches. By Monday, rumors began to appear; yesterday, things spiraled completely out of control."

He also said: "Just knowing that a piece of software has vulnerabilities, even one as large and complex as PHP, is enough for us to find them. I think this will soon become the norm: people can develop exploits within hours, even before they have figured out exactly where the vulnerability is hidden."

2 Behind the patch is a volunteer

The PHP project was forced to move its release time from the originally scheduled Thursday to Wednesday, compressing the time window left for system administrators worldwide by a full day.

The consequences came extremely fast. Germany's Federal Information Technology Center preventively shut down multiple government websites, Finland, France, Belgium and other countries took protective measures for public sector websites, and the U.S. CISA, the EU CERT-EU, and the UK NCSC issued emergency warnings one after another. In its announcement, CERT-EU specifically noted that many commercial and open-source products use PHP as a backend, and may be affected even if they do not directly provide PHP services externally.

And behind all this, there is an even more unsettling fact: the PHP Foundation later admitted that clues to the fix for one of the vulnerabilities had already been found during an external security audit in 2024, but due to insufficient resources, inefficient decision-making processes, and too few people able to deeply understand the internal mechanisms of the PHP engine, the fix was delayed for nearly two years. The foundation itself called this a "structural failure" in its post-incident statement.

This "structural failure" has not been resolved because of this crisis. On Reddit and X, amid the panic, one name was repeatedly mentioned: Ondřej Surý. Before this, not many people had heard this name.

Software developer Ian Landsman wrote on X He wrote a passage that was later widely quoted: "I explained to my wife that there is this one person on whom most PHP distributions in the world depend for maintenance. If something happens to this person, it's over. Everyone will suffer."

There is some exaggeration in this, but it is not far from the truth. Surý does not live in Silicon Valley, nor does he draw a salary from the PHP Foundation. His formal job is Director of DNS Engineering at the Internet Systems Consortium. Maintaining PHP packages is his volunteer work.

What he does is "package" the source code released by the PHP project into software packages that can be installed directly on servers, and make this process as automated as possible. Without this step, a large number of website operators around the world using PHP—including those without the skills to compile from source—would have to scramble to handle things themselves after a vulnerability is disclosed.

Over the past 48 hours, he has undoubtedly become one of the unsung heroes of the entire internet. And this volunteer work has long been supported only by some modest donations. One PHP Subreddit user wrote: "Ondřej will save the internet today."

The change came quickly. The donations he received in these 24 hours roughly equal those of the entire past year. In his words, he had never seen such a scene before.

3 An Interview with The Atlantic

The following conversation is translated from The Atlantic, with reporter Charlie Warzel and interviewee Ondřej Surý.

Charlie Warzel: Please tell me in plain terms what has happened over the past 72 hours.

Ondřej Surý: Earlier this week, the PHP project notified me that there was a serious security vulnerability in the code. By Tuesday, people discovered that someone had leaked information about the upcoming disclosure. The PHP project internally decided to speed up the release process, moving the originally scheduled Thursday release up to Wednesday. Things started to get a bit crazy from then on, because we suddenly had one less day.

Warzel: I'm trying to put this in a larger context: PHP, the programming language that underpins the internet, is used by at most 70% of websites?

Surý: That's the proportion I've heard too.

Warzel: People look for cybersecurity vulnerabilities, not necessarily to launch attacks, but perhaps just for defense. Someone finding a vulnerability is not particularly unusual in itself. The real problem is that this vulnerability disclosure was broad in scope, and website operators had very little time to use before patching it, right?

Surý: I'd like to add one point: the key is the severity of the vulnerability, and this time the severity is very unusual. Remote code execution is the most serious type of vulnerability, because an attacker can execute their own code on servers running PHP. That is why it caused panic across the entire internet. As you said, if about 70% of websites are running PHP, and attackers can really execute code on these servers, the impact would be enormous.

Warzel: You said that despite the panic online, these 48 hours were not particularly crazy for you. From the outside, that is quite surprising. I keep seeing people say: "Only one person is responsible for fixing this vulnerability, and he supports himself through Patreon." That may be somewhat exaggerated, but it is partly true: your work is almost equivalent to one person helping millions of people. Why do you feel this period has not been crazy?

Surý: There are several reasons. First, I have been doing this for a long time, more than 20 years. Many of the things I do have already been automated. Another reason this has not been crazy for me is that I myself actually do not have any systems running PHP. So for me, it is probably just: "Okay, I have a responsibility to internet users." If I had been on a boat in the middle of the Adriatic Sea at the time, that day might have been crazy. That could indeed happen. But this time I had time to prepare the packages.

Warzel: That's quite incredible.

Surý: Even without me, people could still get PHP from other channels and compile it themselves. But for everyone, the process would be much more complicated, and some people do not have the skills to upgrade PHP immediately. The PHP project releases the source code of the language, and what I do is package the source code into software packages that can be installed on servers. This is very convenient, faster, and can be automated. You can install the same package on hundreds or thousands of servers without compiling it yourself.

If I had been unable to participate at the time, the whole process would have taken longer, and some people would not have the skills required. What is truly worth thanking is that the PHP project included me in that small circle of people in the know, allowing me to learn about the situation before the vulnerability was disclosed and prepare in advance.

Warzel: When you received the invitation, did you think "oh no"?

Surý: At this stage of my life, I would probably think: "This is bad, it must be fixed." But at least for me, it does not cause panic. Many people did panic because of it. But my thinking is more like: "Something has gone wrong now, it needs to be solved, and the way to solve it is clear. I have time to prepare." If I had not had time to prepare, the pressure would have been much greater. From my perspective, this was not that tense, because what I do is volunteer work. If I were hit by a bus, it would become someone else's problem.

Warzel: Every time I write a little about cybersecurity and open-source software, I find that there are maintainers taking on this work, people like you who contribute because they care about it. Most of the time, no one knows their names. If one day you really were hit by a bus, would someone be able to take over your work?

Surý: I am indeed considering contingency plans, and I am currently working with the software company Freexian's Raphaël Hertzog communicated. My advantage is that I am experienced and know where to touch to make things work properly. But Freexian also has a lot of professional experience, and if something happens to me, they can take over. Since yesterday, people have donated a lot of money, with small donations and larger amounts as well. I want to thank everyone.

Warzel: Have the donations overwhelmed you?

Surý: Not at the Silicon Valley level yet, but the donations I have received are indeed quite substantial; I have never seen anything like this before. The donations received over the past year were roughly received in these 24 hours.

Warzel: If the vulnerability had not been patched so quickly this time, what would have happened?

Surý: A lot could have happened. The most basic situation is that websites would be damaged or knocked offline. We see this on the internet every day now. Another possibility is that someone gains access and turns these devices into a botnet. I think this is now mainly done by organized crime groups; it is no longer some young person hiding in a basement doing it for fun. They have economic motives: they can sell botnet services, and they can also use these servers to mine cryptocurrency for profit. And these things can still happen, because not everyone has already patched the vulnerability and upgraded PHP.

Warzel: I saw a post on X saying that not all PHP versions can be patched, and that one third of the internet may already be permanently broken or vulnerable. Is that accurate?

Surý: The claim that circulated initially was not accurate. There are ways to patch older versions as well.

Warzel: So the claim that one third of the internet is permanently doomed is incorrect. Good.

Surý: Right, inaccurate. If users take it seriously enough, they can also upgrade these older versions of PHP.

Warzel: This is a frightening moment in cybersecurity. I have seen some people call this vulnerability and other AI Agent attacks "Black October." People worry that both defensive Agents and offensive Agents can discover these vulnerabilities. I have noticed a feeling in the cybersecurity community: they have always worried that vulnerabilities would be exploited or discovered faster than people can cope with, and that future is becoming reality; we are already in it. At the same time, some people believe a balance will form between offense and defense: if there are Agents that act continuously and are good at identifying and exploiting vulnerabilities, there will also be Agents that act continuously and are good at defending against vulnerabilities.

Surý: We have already seen things accelerate; that is completely true. Defenders can also use large language models to proactively discover vulnerabilities. I think the problem ultimately comes down to something simple: people often take IT infrastructure for granted.

Many places do not put enough priority and funding into maintaining IT infrastructure. Those affected are not only enterprises; there are also many outdated consumer electronic devices, and they will be attacked as well. I agree that everything is accelerating now, and this places a heavy burden on the people responsible for defense. At the same time, perhaps this incident will become a turning point and make us start taking this seriously.

Warzel: Do you think such a shift will really happen?

Surý: I may be wrong, but I am still an optimist and believe people will eventually realize that we cannot go on like this forever. This disaster has been brewing for a very, very long time. What is happening now is just a wake-up call; there will be more wake-up calls in the future.

Warzel: I am surprised that the infrastructure in some parts of the internet can depend on one or two people. That fragility is worrying. What changes would you like to see?

Surý: When I first started doing open source, I thought it was interesting. To some extent I still do. But the environment around it has changed. Open source sometimes makes people feel they are being exploited. I hope to find a new model that allows those who benefit most from open source work to give back for the time and labor of open source workers. I hope companies realize that this is exploitation. No exploitation can last. If this continues, it will eventually lead to bad outcomes, because people doing open source work will ultimately lose the motivation to keep contributing.

Warzel: It sounds like you do not care much about personal fame in all this. However, yesterday you did a lot of work and helped a large number of users around the world. When you lay down last night, knowing you had played such a role, how did you feel?

Surý: My wife says I am emotionally numb, but actually I am not. That feeling is good. Seeing social platforms full of messages thanking me and receiving thank-you emails makes me very happy. It gives meaning to what I do. I feel my work is valuable.

Warzel: The whole internet thanks you for your efforts. At this moment, do you have any advice for ordinary users to help them improve their cybersecurity awareness?

Surý: I suggest everyone trust experts. In a crisis, we all do this: ask experts and trust them. Trust that the people responsible for maintaining these systems know what they are doing. That is all we can do.

Sources:

This article is from the WeChat public account "InfoQ" (ID: infoqchina), author: Tina, published by 36Kr with authorization.