Ondrej Sury: The Volunteer Who Saved the Internet From PHP2Shell

When PHP2Shell nearly turned into a "PHPocalypse" this week, the person who did much of the work of getting fixes onto servers wasn't a big tech company, a government agency or even an employee of the PHP Foundation. It was Ondrej Sury (properly spelled Ondřej Surý), a volunteer in Czechia who has spent more than 20 years packaging PHP in his spare time. Within hours of PHP's emergency release, his builds let Debian and Ubuntu servers worldwide install the patch with a single command, including servers on PHP versions that officially stopped getting updates years ago.

The internet still works this weekend partly because of him. His story is also a pointed reminder of how much of the web rests on people most of us have never heard of. Here's who Ondrej Sury is, what he actually did during PHP2Shell, and what developers and companies should learn from it.

The short version

• Who: Ondrej Sury, a Czech engineer who works on DNS software by day and maintains PHP packages for Debian and Ubuntu as a volunteer.

• What he did: turned the PHP Foundation's source-code fixes into ready-to-install packages and shipped them on October 21, the same day as the official release.

• The extra mile: he also backported the fix to end-of-life versions all the way back to PHP 5.6, which PHP itself no longer supports.

• The payoff: donations in 24 hours roughly matched what he usually receives in a year.

• The lesson: critical internet infrastructure often depends on a handful of underfunded volunteers.

What was at stake

PHP is the programming language running behind the scenes on a huge share of websites. NDTV puts it at roughly 70 percent, handling things like loading pages and processing logins. PHP2Shell (CVE-2026-109618 and CVE-2026-109619) is a pair of bugs in the PHP engine itself that could let an attacker run code on a server without logging in. In the worst case that means stealing data, planting malware or taking sites offline. Our PHP2Shell explainer covers the technical details.

The timing made it worse. According to NDTV, researchers using a frontier AI model from OpenAI flagged the flaws, and the PHP Foundation was preparing a coordinated fix. Then details leaked on a forum on Tuesday, October 20, before the patch was ready. Cloudflare CEO Matthew Prince described what happened next:

"In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post-announcement, hundreds of thousands within 2 hours, and millions now."

Tech commentator Matt Shumer offered a useful analogy, quoted by Reason: "Someone discovered that millions of buildings in the country have the same broken lock, and now everyone knows how to open it. The lock maker has sent out a fix, but every building owner has to install it themselves, and many haven't yet."

That last part, getting the fix installed, is exactly where Ondrej Sury comes in.

Who is Ondrej Sury?

Sury lives in Czechia, and his day job has nothing to do with PHP. As The Atlantic's Charlie Warzel reported (via Reason), he is director of DNS engineering at the Internet Systems Consortium (ISC), the nonprofit behind BIND, some of the most widely used DNS software on the internet. In other words, he already spends his working days on infrastructure the internet can't function without.

In his spare time, he does something else most people never think about. For more than two decades he has maintained PHP packages for Debian and Ubuntu Linux. The PHP Foundation publishes PHP as source code, but most servers don't compile software from source. They install pre-built packages with a command like apt install. Sury's repository (packages.sury.org, often called "deb.sury.org") and his Ubuntu PPA (ppa:ondrej/php) are where a huge number of servers get their PHP, especially when they need a newer or older version than their Linux distribution ships.

If you've ever set up a PHP or Laravel server on Ubuntu and followed a tutorial that said add-apt-repository ppa:ondrej/php, you've used his work.

He isn't paid by the PHP Foundation for any of this. The only compensation is modest donations from users.

What Ondrej Sury did during PHP2Shell

He was ready before the leak

Sury told The Atlantic that the PHP project brought him in before the public release so he could prepare packages in advance. When details leaked, the release was moved up a day, to Wednesday instead of Thursday. Because he'd already had time to prepare, the rush didn't throw him.

"I'm in the stage of my life where I was like, This is bad. It needs to be fixed. But it doesn't cause panic, at least for me," he said. "It did cause panic for a lot of people. But you know, it was more like, We have a situation, it needs to be solved, and this is how we do it. And I have time to properly prepare."

He shipped packages the same day

On October 21, alongside PHP's official release, Sury's repository published patched builds for Debian and Ubuntu. For the supported branches, that meant PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. For anyone using his repository, patching became one routine update command instead of hours spent compiling PHP from source in the middle of an active attack.

He patched the versions nobody else would

This is the part that matters most for small businesses, schools and forgotten servers. PHP officially fixes only its supported branches. Older versions are end-of-life, so on paper they get nothing. Sury backported the fix to them anyway:

How the PHP2Shell fix travelled from PHP's source code to millions of servers.

PHP branchVersion with the fix in Sury's repositoryOfficial status8.58.5.12Supported8.48.4.27Supported8.38.3.36Supported8.28.2.35Supported8.1, 8.08.1.34, 8.0.30 (backported)End of life7.4, 7.3, 7.2, 7.17.4.33, 7.3.33, 7.2.34, 7.1.33 (backported)End of life5.65.6.40 (backported)End of life since 2018

Plenty of real-world sites still run on PHP 7.x or even 5.6 because an old plugin, a custom app or a vendor product won't run on anything newer. Without these backports, those servers would have had no quick fix at all. The PHP subreddit summed up the mood that day: "Ondřej will save the internet today."

He stayed modest about it

Asked about being called a hero online, Sury played it down:

"I've been doing this for a long time, over 20 years. A lot of the stuff that I do is automated. But the reason it was not crazy for me was that I actually don't have any system running PHP myself. So for me, it was like, sure, I feel a responsibility toward the users of the internet. It would be a crazy day for me if I was on a boat in the middle of the Adriatic Sea. That could happen. But I had time to prepare the packages."

Read that again: the person who helped patch a large share of the world's PHP servers doesn't run PHP himself. He did it out of a sense of responsibility.

The "one random person in Nebraska" problem

Reason's Eric Boehm pointed to xkcd comic #2347, "Dependency", which programmers have been sharing all week. It shows all of modern digital infrastructure as a towering stack of blocks, held up near the bottom by one tiny project "some random person in Nebraska has been thanklessly maintaining since 2003." As Boehm noted, PHP2Shell made the joke literally true, except the random person lives in Czechia.

Sury's own line about the boat in the Adriatic is the scary part. If the one person who packages your critical software happens to be on holiday, sick or simply burned out on the day it matters, there may be nobody else ready to step in. Engineers call this the bus factor: how many people would have to disappear before a project stalls. For a lot of critical open-source infrastructure, that number is uncomfortably close to one.

Sury didn't sugar-coat it. He said AI has sped up both attacks and defence, but the deeper problem is that infrastructure is taken for granted and underfunded. Open-source work, he said, can feel like exploitation, and he wants the companies that benefit most to pay for it.

There was one bright spot. After the story spread, donations jumped. Sury said contributions in just 24 hours roughly equalled what he'd normally receive in a year. That's welcome, but a one-off spike after a near-disaster isn't a sustainable way to fund infrastructure that millions of businesses depend on every day.

Why this will keep happening

PHP2Shell won't be the last incident like this. Reason notes that CrowdStrike reported twice as many "agentic intrusions" (hacks carried out by autonomous or semi-autonomous AI) in August as in July, and that number doubled again in September. AI is helping researchers find serious bugs faster, as it did here, but it is also helping attackers exploit them faster. We've looked at that shift in our piece on AI agents as insider threats.

When the gap between disclosure and mass exploitation shrinks to minutes, the speed of the last mile, getting a fix from source code onto real servers, becomes just as important as the fix itself. This week, that last mile ran through one volunteer's packages.

What developers and companies can learn from Ondrej Sury

1. Know where your software actually comes from

Many teams can name their framework and their database but couldn't tell you who builds the PHP, Node.js or Python binaries on their servers. Find out. Run apt policy php8.3 (swap in your version) on a Debian or Ubuntu server and see which repository your packages come from. If it's packages.sury.org or ppa.launchpadcontent.net/ondrej, you depend on Sury's work.

2. If you use his repository, update now

For servers already using Sury's repository, patching is a routine update:

sudo apt update

sudo apt install --only-upgrade 'php*'

# then restart PHP so the new version is actually used

sudo systemctl restart php8.3-fpm   # match your version, or restart apache2

Then confirm the version your website is running, not just the command line. php -v only checks the CLI, so also check your hosting panel or a temporary phpinfo() page that you delete straight afterwards. For containers, follow our PHP2Shell Docker rollout checks, and for a full server-by-server rollout see PHP2Shell patches for PHP web servers.

If you're on an end-of-life version, read the package changelog before deploying. A backport is a careful repair, not a full upgrade, and it can occasionally change behaviour. Treat it as breathing room to plan a move to PHP 8.2 or newer, not as a reason to stay on PHP 7.x for another five years.

3. Fund the projects you depend on

If your business earns money from PHP, put a little of it back. That can mean donating to the maintainers whose packages you install, supporting the PHP Foundation, or setting aside a small open-source budget your team reviews every year. If a company spends thousands a month on cloud hosting, a few hundred to the people who keep its runtime secure is cheap insurance.

4. Plan for the day your upstream isn't there

Ask what you would do if your PHP packages didn't arrive on patch day. Could you build from source? Do you have a paid support option? Can you put a WAF in front of your sites quickly? You don't need a perfect answer, but you need an answer before the next emergency, not during it.

The bottom line

Big companies and AI models both played a part in PHP2Shell. AI helped find the bugs, and Cloudflare's network measured the flood of attacks and pushed emergency rules. But when millions of servers needed a fix they could actually install, a big part of the answer was one volunteer in Czechia who had prepared ahead, worked fast and remembered the old versions everyone else had written off. As Reason put it, in the war between AI hackers and AI defenders, it's still humans who are the heroes, at least for now. The least the rest of us can do is make sure people like Ondrej Sury aren't doing it alone, or for free.

Sources: NDTV: Meet Ondrej Sury · Reason: The Man Who Saved the Internet · LinuxCompatible: Sury.org PHP2Shell packages · xkcd #2347: Dependency