A volunteer from Czechia, Ondřej Surý, has single-handedly built ready-to-install packages that fix two serious flaws in PHP. Nearly 7 in 10 active websites worldwide run on the language.
The flaw is called php2shell. It lets an attacker run malicious commands remotely and take full control of a server. It went unnoticed in the code for 14 years. Surý says it is among the most dangerous flaws of recent decades.
PHP is an open-source language and one of the foundations of the internet. The two flaws turned up during a technical investigation using new artificial intelligence models from OpenAI. OpenAI and the PHP Foundation worked together for two months. OpenAI president Greg Brockman admitted the process was too slow and manual for the pace of the algorithms.
The PHP Foundation is the non-profit group that leads the development of the language. It wrote the code for the fix. But the code has to be compiled, secured and turned into install packages, or system administrators cannot use it. Surý does that work as a volunteer, with a small group of other volunteers.
Surý also heads DNS engineering at the Internet Systems Consortium. With his colleague Rémi Herzog, he also maintains old versions of PHP that lost official support long ago.
Governments, big companies and network administrators were urged to install the fixes at once or to isolate their servers completely. Thousands of websites in Europe and around the world were taken offline for a time to stop data leaks.
Amazon said it spotted similar automated attacks several days before the official fix was ready. Cloudflare chief executive Matthew Prince said the company's network saw several thousand attack attempts before the fix was published. In the first 45 minutes after that, the number rose to tens of thousands. Within two hours it passed hundreds of thousands, and then reached several million a day.
Surý says the situation becomes critical when details of a fix are published. Criminals then use large language models to study the patched code and quickly write malicious programs.
International stock markets fell because of the uncertainty. Shares in the cybersecurity firms Cloudflare, Okta, Datadog and CrowdStrike rose by up to 7.5% in one trading session. Markets expect a sharp rise in investment in cyber defence worldwide.
US journalist Charlie Warzel called Surý the unnoticed hero who saved the internet. A view spread on social media that the stability of the global network depends on the integrity of one person. Surý rejected the label "hero". He says his job is to turn complex technical code into a form that ordinary users can handle. Asked when security will be complete, he answered: never.
He says big organisations have already protected themselves, but many firms and people do not know they have PHP on their devices. Millions of small servers will never get the fixes and will stay open to attack indefinitely, like home routers and smart devices that go years without updates.
Surý accuses tech giants, whose fortunes run to hundreds of billions of dollars, of building wealth on the work of developers who maintain digital infrastructure for free. He calls it exploitation that their unpaid work brings in huge profits while no real resources go back to the community. There is moral discontent in the open-source community.
Surý says companies cannot hide behind the autonomy of software when it causes harm. If a digital agent makes a mistake or is tricked into attacking, he says, the blame lies fully with those who released it without strict security controls.
Silicon Valley leaders want artificial intelligence built into defence systems that stop attacks before they happen. They also propose that the state step in by forcing remote updates on unprotected servers.