The Man Who Saved the Internet Yesterday
Ondřej Surý was a relatively anonymous volunteer working on PHP security. Then the internet exploded.
On Tuesday, the internet learned of two major security flaws in PHP, a programming language that powers approximately 70 percent of websites worldwide. Cybersecurity researchers from OpenAI discovered the vulnerabilities, which could grant attackers complete control over servers, allowing them to steal, copy, or even take websites offline.
The PHP Foundation, responsible for maintaining the language, had already been alerted to the issues but the news wasn't disclosed until it was leaked on a forum before a fix could be implemented.
In the chaotic 72 hours that followed, numerous parties raced against time to patch the vulnerabilities: the PHP Foundation, developers globally, and malicious actors attempting to exploit the flaws. Matthew Prince, CEO of Cloudflare, revealed that in the 10 hours prior to public disclosure, they observed thousands of exploitation attempts. Within just 45 minutes, those attempts surged to tens of thousands, skyrocketing to hundreds of thousands in two hours, and eventually reaching millions.
Once the patch was made available yesterday, websites worldwide were forced to shut down temporarily to apply the fix. This included vital government websites in Germany and Finland, critical hospital and school systems in Europe, and popular international platforms such as 4chan. Amidst the scramble, one individual emerged as a crucial figure in the internet's defense: Ondřej Surý.
Software developer Ian Landsman likened Surý to a hero on Reddit and X, stating, "If anything happens to this guy, that's it. Everyone is screwed."
Surý, based in the Czech Republic, isn't employed by the PHP Foundation but contributes his time as a volunteer. His role extends beyond his primary job at the nonprofit Internet Systems Consortium where he oversees domain-name-system engineering. His dedication to maintaining and automating PHP patches was instrumental in the rapid deployment of the fix. Over the past 48 hours, he has made significant contributions, often relying on modest donations as his sole compensation.
Despite the crisis, Surý emphasized the importance of automation in his work. With over two decades of experience under his belt, much of his tasks are automated, allowing him to prepare and distribute patches swiftly. However, he acknowledged that his contribution is just one piece of the puzzle. While he plays a vital role, other volunteers and the broader open-source community are equally responsible for keeping the internet secure.
Surý's efforts highlight the critical importance of a coordinated response from volunteers worldwide to safeguard the web's infrastructure.
Written by urgent.news from The Atlantic's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
