When the PHP Foundation published emergency fixes on 21 October, what it published was source code. Source code is not something a hosting company installs on a Tuesday afternoon across four hundred servers. Somebody has to turn it into packages first.
For Debian and Ubuntu — the two Linux distributions that sit beneath a great many of the web servers in use — that somebody has been one man, working in his spare time, for more than twenty years.
Who he is
Ondřej Surý works as director of DNS engineering at the Internet Systems Consortium, a US non-profit. That is his job. Maintaining the PHP packages for Debian and Ubuntu is not: it is what he does with the rest of his time, taking the source code the PHP project releases and turning it into packages that a server operator can install without any special expertise.
He had been given advance warning of the vulnerabilities. Then details leaked online, the planned release was brought forward, and his timetable collapsed.
“I got aware that this is quite severe and I don’t have that much time to prepare the packaging of the PHP that I provide to people,” he told the BBC’s Shiona McCallum.
He dropped everything and did it for free.
What that week felt like
“The feeling is like I am responsible for all these people and I can’t fail them,” he said.
Asked how it felt to be described online as one of the people who helped save the internet, he deflected. “It’s kind of fulfilling because I sense my work has a purpose,” he said. “At the same time, I feel that not enough credit has been given to other people who has been part of this, like the PHP project people.”
He was not the only one. Other maintainers around the world were doing the same work for other distributions at the same time — which is rather the point about how much of the internet’s plumbing rests on a small number of named individuals.
The number
In the days that followed, Surý received more than $10,000 (about £7,470) in donations.
“This week is basically about a year’s worth of the contributions that I got before,” he said.
Read that twice. The annual funding for the person who packages PHP for Debian and Ubuntu is, in a normal year, roughly ten thousand dollars — raised from the goodwill of the people who use his work. The companies whose revenue depends on that work are rather larger.
He said the big technology firms should take more responsibility for the open source software they depend upon. “I think they should be more responsible,” he said. “If you just take and don’t give back then it will backfire.”
What happens if he stops
Surý has thought about it. He said colleagues at the software company Freexian could take over, but they do not yet have the same accumulated experience. Asked directly whether much of the responsibility ultimately rested with him, he agreed: “Yes, that’s pretty much true.”
And he expects it to happen again
His read on the near future matches what the security industry has been saying all week, and it is not comforting.
“I think this is was the most severe incident in years, but I think that because of the AI capabilities are getting better in the cyber security, this might not be an isolated incident,” he said. “And people should be prepared to act this quickly more often because incidents like this might happen in the future — in the near future.”
Why this matters here
If your site is on cPanel with a Bangladeshi host, and your provider applied the PHP fix this week through their operating system’s package manager rather than compiling it themselves, then the thing they installed came down a chain that passes through this man’s spare time. Almost nobody in that chain knows his name.
There is a practical conclusion as well as a sentimental one. Software that your business depends on, and that nobody is paid to maintain, is a risk on your balance sheet whether or not you have written it down. The fix arrived quickly this time because one person happened to be available and willing.
Related: the two flaws and what to update, and how the embargo leaked.
