PHP Maintainer Ondřej Surý Rushed Fixes to Debian and Ubuntu Users
Ondřej Surý worked in his spare time to package PHP security fixes for Debian and Ubuntu after vulnerabilities triggered an international scramble to install…
PHP supports websites around the world, and security flaws in the programming language prompted an international scramble to install updates. PHP developer became unsung hero in that effort: Ondřej Surý, who volunteered to turn fixes into packages that operators could install more easily on Debian and Ubuntu.
The PHP Foundation released fixes for two major vulnerabilities identified with help from artificial intelligence. Surý dropped his other work to package those fixes for people who might struggle to install them, he told BBC News. His work helps website operators get the updates onto their servers.
“The feeling is like I am responsible for all these people and I can't fail them,” Surý said.
Surý’s contribution is not his full-time job. He works as director of DNS engineering at Internet Systems Consortium, a US non-profit organisation, and has spent more than two decades maintaining PHP software packages for Debian and Ubuntu in his spare time.
He takes source code released by the PHP project and prepares it in a form that operators can install without needing the same level of technical expertise. When the vulnerabilities became known, that practical step mattered: a security fix has to reach systems that need it.
The urgency increased after information about the weaknesses leaked online. The PHP project had given Surý advance warning, but the planned release was brought forward. He said he then had less time to prepare the packages he provides.
“I got aware that this is quite severe and I don't have that much time to prepare the packaging of the PHP that I provide to people,” he said.
He was confident that his experience and preparation would help him complete the work. Other developers around the world were also working to distribute the patches, according to the BBC report.
PHP developer became unsung as support grows
Surý said he received an outpouring of support from people who rely on his packages. Donations exceeded $10,000 (£7,470) in just a few days.
“This week is basically about a year's worth of the contributions that I got before,” he said.
He welcomed recognition but said the work belonged to a wider group. When asked about people describing him online as someone who helped “save the internet”, Surý said he felt his work had purpose, while noting that the PHP project’s contributors deserved credit too.
“It's kind of fulfilling because I sense my work has a purpose,” he said. “At the same time, I feel that not enough credit has been given to other people who has been part of this, like the PHP project people.”
The incident also raised questions about how open-source infrastructure is supported. Surý argued that major technology companies should contribute more to the software they rely on.
“I think they should be more responsible,” he said. “If you just take and don't give back then it will backfire.”
Surý has considered what would happen if he could no longer maintain the packages. He said colleagues at software company Freexian could take over, although they do not yet have the same accumulated experience.
He also warned that artificial intelligence may be speeding up the discovery of security vulnerabilities, helping both attackers and those working to stop them. Surý described the incident as “the most severe incident in years,” according to the BBC report.
Source: bbc.com
