Ondrej Surý was on holiday in Italy when vulnerabilities in PHP, the programming language used by around 70% of websites, created an urgent security problem. After a patch for two flaws discovered by US security companies was leaked, attackers could potentially alter websites, steal customer data or access other computers.
Surý, a 49-year-old Czech engineer, packaged the corrected code so developers could install it quickly. He also adapted the fix for older PHP versions, saving thousands of developers from having to carry out the work themselves and helping protect millions of websites.
Although he received public thanks and was described in media reports as an anonymous hero, Surý considers the work routine. He is the main maintainer of PHP and other packages for Debian, a voluntary role supported on Patreon by 490 people who contribute 1,539 euros per month.
The incident underlined the dependence of internet infrastructure on open-source software maintained by individuals. Courtney Miller, a professor at George Washington University, said many companies benefit from open-source projects even though they are often led by a single person. Maintainers can eventually stop because of a new job, a loss of interest or a lack of time.
The pressure is increasing as artificial intelligence accelerates the search for vulnerabilities. Michael Schwartz, technical director at cybersecurity company Censys, said AI tools could lead to more flaws being discovered, while also improving defensive capabilities. The result is an increasingly fast competition between attackers and defenders that may be difficult for small volunteer teams to handle.
Daniel Stenberg, the developer behind the curl data-transfer tool, argued that companies benefiting from open-source software should contribute to the projects they rely on. Surý also said commercial companies should be held accountable for products they sell and should help fund the open-source software used in their systems.
Surý believes the main challenge is finding new maintainers. He said free software once seemed fresh and exciting, while today the speed of the internet and the number of available technologies may overwhelm younger people. In his view, maintaining essential software requires a willingness to do something for others.
Experts warned that similar incidents may occur again. Jesús María González Barahona, a professor of Telematics Engineering at Rey Juan Carlos University, said widely used components could be exposed to rapidly exploitable flaws, potentially affecting critical infrastructure. He called for greater investment from both companies and public institutions.
Sources: El País Sociedad.