The PHP Developer Who Became an Unsung Hero of the Internet

A software developer named Ondřej Surý has spent more than 20 years quietly helping to keep websites around the world safe and running. He does this mostly in his spare time, and he does not get paid for it. This week, his work became more important than ever when two serious security flaws were found in a popular programming language called PHP — and Surý jumped in to help fix the problem fast.

PHP is a programming language that powers a huge number of websites across the internet. When security experts found two major flaws in PHP, they worried that cybercriminals could use those weaknesses to break into websites. The PHP Foundation quickly released fixes, but many website operators found them hard to install on their own. That is where Surý came in. He took the fixes and turned them into easy-to-install packages so that everyday website owners could protect themselves without needing to be experts.

Surý works full-time as a director of a technical field called DNS engineering at a nonprofit group called Internet Systems Consortium. But for more than two decades, he has volunteered his free time to help maintain PHP software for two popular versions of Linux — an operating system called Debian and another called Ubuntu. Linux is a free operating system, similar to Windows, that many web servers use to run websites. Surý takes the original code from the PHP project and turns it into packages that website operators can easily install. It is careful, skilled work that most people online never see or think about.

When the security flaws were discovered, Surý had already been given an early warning by the PHP project. However, information about the weaknesses leaked online before the planned fix was ready. That meant everything had to speed up quickly. Even so, he felt confident that his years of experience would help him get the job done in time. "I got aware that this is quite severe and I don't have that much time to prepare the packaging of the PHP that I provide to people," he said.

Some people online praised Surý and others like him for helping to "save the internet" this week. His response was humble. "It's kind of fulfilling because I sense my work has a purpose," he said. He also made sure to point out that other developers around the world worked hard too, and he felt they deserved more credit. The event showed just how much the internet can depend on a small group of dedicated volunteers working behind the scenes.

One surprising result of this crisis was a wave of support from grateful users. Surý said he received more than $10,000 in donations in just a few days — about a full year's worth of contributions compared to normal times. He used the moment to send a message to large technology companies that rely on free, open-source software like PHP. He said those big companies should do more to support the developers who keep that software safe. "If you just take and don't give back then it will backfire," he warned.

Surý also raised concerns about the future of internet security. He believes that artificial intelligence, or AI, is making it easier and faster to find security flaws in software. That could help both cybercriminals trying to cause harm and security experts trying to stop them. He thinks this week's crisis may not be a one-time event. His words serve as a reminder that keeping the internet safe is an ongoing challenge that requires skilled, committed people — even if most of us never know their names.