Ondrej Surý, who saved the internet: You have to want to do something for others

Ondrej Surý, a Czech engineer who maintains PHP packages for Debian and other systems, helped limit the fallout from two serious PHP vulnerabilities discovered in August. PHP runs roughly 70% of the world’s websites, and details of the flaws leaked before an official patch was available, leaving sites exposed to tampering, data theft and wider system access. Surý quickly packaged the fixes and made them available for older PHP versions, allowing developers to update far more easily. His intervention highlights how much internet security relies on individuals maintaining open-source software in their spare time, sometimes with a single volunteer responsible for a widely used component.

The deeper concern is that this arrangement is fragile and increasingly strained. Volunteers can leave projects when work, time or interest changes, while companies often depend on open-source tools without helping pay for their upkeep. Surý and other experts argue that businesses should fund the software they rely on and be held responsible for maintaining commercial products; public funding and government action are also needed. AI is accelerating vulnerability discovery, benefiting defenders as well as attackers, but raising the volume and speed of work for maintainers. Experts warn that more crises involving widely used software are likely, and that new contributors and sustained resources are essential to prevent a small group of volunteers from bearing responsibility for critical digital infrastructure.