Who keeps the internet running, and what happens when they can no longer afford to? An expert explains

Open-source software powers much of the internet, but maintaining it relies heavily on a small number of dedicated volunteers. Czech software engineer Ondřej Surý maintains PHP packages for Debian and Ubuntu, even for older releases that no longer receive official updates. Surý and others patched the widely used PHP programming language following critical security flaws discovered in October, which prompted services like Japan's Finance Ministry and Wikipedia to shut down in precaution.

These vulnerabilities were the most serious type, allowing attackers to execute arbitrary code on remote machines.

When ethical researchers discover critical flaws, they privately inform the affected project. Fixing the issue depends on the project's size and resources. In PHP's case, maintenance falls to volunteers and few paid employees. The recent surge in vulnerability reports highlights how AI tools make it easier to identify potential flaws, but human expertise is still crucial for assessing and fixing them.

AI can assist maintainers in finding vulnerabilities, but it requires supervision by experts to avoid false positives or overlooked serious issues.

The sustainability of open-source software is under scrutiny as essential projects depend on a shrinking pool of maintainers. Surý believes businesses profiting from open-source software should contribute to its maintenance. Despite the challenges, those who initially embraced free software remain driven by its ideals.