An interview with Ondřej Surý, a volunteer who maintains and helps automate PHP patches, about his role in fixing two critical PHP security vulnerabilities
On Tuesday, the world found out about two massive security vulnerabilities in PHP, a programming language that is used by roughly 70 percent of websites.
Context & Ripple Effects
PHP’s maintainers disclosed two critical unauthenticated RCE flaws and moved the patch release forward after CVE IDs began circulating, turning release engineering into an urgent security-control issue. The disclosure was tied to a memory-management flaw identified in August via GPT-5.6 Sol.
The available fixes cover PHP 8.2 and newer; legacy PHP deployments depend on third-party vendors for remediation. That makes Surý’s patch-maintenance and automation work consequential beyond the upstream releases themselves.
First-order effects
- Web-serving PHP operators on supported releases must deploy the security updates for the two unauthenticated RCE vulnerabilities.
- Organizations running pre-8.2 PHP cannot rely on the upstream releases and must obtain fixes from their third-party vendors.
Second-order effects
- Third-party PHP distributors become the remediation bottleneck for legacy deployments, while operators must inventory versions and validate vendor-supplied patches.
- The early release after CVE circulation puts greater weight on coordinated disclosure and automated patch distribution rather than a fixed release timetable.
Third-order effects
- If critical fixes continue to depend on a small number of volunteer maintainers, PHP’s security posture will increasingly hinge on automation and the capacity of its maintenance pipeline.
- AI-assisted vulnerability discovery sharpens the discovery–remediation throughput gap: finding a flaw faster matters only if maintainers and downstream vendors can ship fixes at comparable speed.
The trend: Critical open-source infrastructure is being pushed toward automated remediation and stronger vulnerability coordination as AI compresses the time between flaw discovery and patch demand.
Related: Vulnerability coordination layer · Discovery–remediation throughput gap · PHP · PHP Foundation details the emergency fixes · PHP2Shell disclosure
Related Coverage
- AI Is Changing Everything About Hacking. No One Knows What Happens Next 404 Media · Jason Koebler
- What Is PHP? Why Are Government and Business Websites Going Offline? New York Times
- NSA Advisory: Critical Patches Recommended for PHP Vulnerabilities Central Security Service · National Security Agency
- PHP releases emergency fixes for 2 critical vulnerabilities CyberScoop
- Websites taken down worldwide as critical cyber-security update issued BBC
- PHP2Shell Leak Sends Security Teams Scrambling Forrester · Sandy Carielli
- Cyber agency warns websites may go dark as PHP prepares critical fix Reuters
- PHP has critical vulnerabilities impacting millions of websites, emergency patch out [Update] Neowin · Usama Jawad
- “Even some world leaders weighed in. The Dutch prime minister said he was closely monitoring the situation. Japanese Prime Minister...” — good morning! — https://www.reuters.com/... @n0toose@chaos.social
- Major US, Europe Websites Go Dark to Protect Against PHP Vulnerabilities the NSA Found Tech Times · Isaiah Richard
- The disastrous PHP vulnerabilities were exploited days before the patch The Verge · Emma Roth
- PHP flaws exploited days before disclosure, Amazon asks users to update immediately Moneycontrol
- ISC has been fortunate to have @ondrej as our Director of DNS Engineering since 2017. But independently of his day job, he is an important maintainer of PHP packages for Debian and Ubuntu. — This has become even more significant over the last few days as the PHP RCE vulnerabilities have been disclosed. … @iscdotorg@fosstodon.org
- “From where I stand, it was not stressful, because I'm doing this as a volunteer, and if I get hit by a bus, then it will be someone else's problem.” — Indeed. — https://archive.is/... @daedalus@eigenmagic.net
- New: AI is making it so much easier for hackers to discover serious vulnerabilities. This applies both to people with little skill, and researchers with a lot of expertise. If you can't accept AI is exceptional at finding critical bugs, you're not living in reality — https://www.404media.co/... @josephcox@infosec.exchange · Joseph Cox
- Rush is on to patch a software vulnerability that could impact 70% of websites worldwide Associated Press
- The biggest-ever internet security threat has been known for 22 years. AI made it a crisis in 2 days CNN · David Goldman
- Race to update services' computer systems after cyber-security flaw found BBC · Tom Gerken
- Cloudflare sees millions of exploit attempts after PHP disclosure Reuters
- [PHP Security Alert] Millions of Attack Attempts Within Hours of Flaw Disclosure The Asia Business Daily · Lee Eunseo
- PHP2Shell attacks began four days before patches, Amazon says, as attempts hit millions SiliconANGLE · Duncan Riley
- Amex Says App and Website Disruptions ‘Not Caused by a Security Vulnerability’ Gizmodo · Matt Novak
- Cloudflare says it deployed WAF mitigations for all free and paid tier customers to combat two PHP flaws by default, about nine hours ahead of public disclosure Cloudflare
- Usage statistics of PHP for websites W3Techs
- AI found a critical PHP flaw. The bigger failure began in 2024. The New Stack · Steven J. Vaughan-Nichols
- Scale of cyber-security flaw ‘unprecedented’ but no sign of breaches, says expert BBC
- Japan to simulate cyberattacks as PHP flaws roil global internet Reuters
- Critical PHP vulnerabilities threaten your NAS, not every vendor has a fix AppleInsider · Andrew Orr
- What is PHP and why did it take government websites offline? Reuters · Leo Marchandon
- PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet Wiz
- South Korea Has 110,000 Hosts Vulnerable to Critical PHP Flaws ETNEWS
- PHP flaws draw millions of hacking attempts amid global push for fixes FCW · David DiMolfetta
- PHP2Shell exposes the weakness in coordinated vulnerability disclosure InfoWorld · Taryn Plumb
- Introducing Machine Gods Platformer · Casey Newton
- Here's how to protect your information from the PHP flaw, according to cybersecurity pros Business Insider · Truman Dickerson
- PHP2Shell: 22M exposed servers at risk as emergency patches released TechTarget · James Walker
- OpenAI says ChatGPT Sol helped uncover critical PHP flaws that could affect 70% of websites Tom's Hardware · Etiido Uko
- AWS analysts say that at least one actor attempted to exploit the PHP2Shell vulnerabilities on October 17, four days before their public disclosure and patching Wired · Lily Hay Newman
- This was my thought as well. It's important to patch, but this is significantly harder to trigger than the Ruby YAML thing (mentioned in this article) https://eliastaylor.com/... #php @Schneems@ruby.social · Richard Schneeman
- Hacking attempts rise after flaws found in program affecting 70 percent of websites NPR · Kate Bartlett
- I'm a CTO who was awake for 48 hours because of the PHP crisis. October feels like the month of hell for tech. Business Insider · Tim Paradis
- 🚨 The Night Hacking Hit Machine Speed Superintelligence
- Global Rush to Fix Security Flaw Uncovered by A.I. Leaves Sites Offline New York Times · Lynsey Chutel
- Hackers pile on PHP2Shell as AWS reveals attacks began before disclosure The Register · Carly Page
- [critical] PHP2Shell: critical unauthenticated RCE in PHP core incident updates
- AI-discovered PHP security flaws prompt global scramble to patch websites Quartz · Cris Tolomia
- PHP Vulnerability Wrap-Up, (Fri, Oct 23rd) SANS Internet Storm Center, InfoCON
- PHP flaw exposes shrinking window to patch software Financial Express · Ojasvi Gupta
- The Man Who Saved the Internet Reason · Eric Boehm
- A.I. Has Made It Easy to Brute Force the Internet Pixel Envy · Nick Heer
- AWS says hackers tried to exploit PHP security issues days before fix — as Cloudflare CEO says it saw a huge rise in targeted attack attempts TechRadar · Sead Fadilpašić
- Cloudflare Reports Millions of Exploit Attempts After PHP Flaws Disclosed PYMNTS.com
- The one guy who manages most of PHP distribution is a volunteer, of course ↦ Six Colors · Dan Moren
- PHP's security scramble is just a preview: AI is digging up flaws faster than maintainers can fix them The New Stack · Paul Sawers
- Everspin Blocks PHP Attacks for Clients Ahead of Official Patch Seoul Economic Daily · Ji-won Gim
- PHP releases emergency fixes as some of the world's biggest websites say they were targeted by hackers TechRadar · Sead Fadilpašić
- PHP flaws trigger surge in hacking attempts worldwide Tech in Asia · Minh Le
- CZ Warns Crypto Users as Critical PHP Vulnerabilities Put Websites at Risk CryptoPotato · Wayne Jones
- PHP Patches Critical PHP2Shell Vulnerabilities as Hosts Across the WordPress Ecosystem Race to Protect Customers The Repository · Rae Morey
- PHP2Shell: Haven't patched yet? Take these steps now to mitigate ZDNET · Charlie Osborne
- What in the PHP is going on? … It's all anyone can talk about as websites and apps around the world … Tech Brew · Lindsey Choo
- PHP Foundation ‘under-funded’ with one full-time staff member, director says Reuters · Toby Sterling
Discussion
-
@ianlandsman
Ian Landsman
on x
Explaining to my wife how there's this one guy. And he alone is responsible for most of the world's distribution of PHP. And if anything happens to this guy, that's just it. Everyone is screwed.
-
@cwarzel
Charlie Warzel
on x
His name is Ondřej Surý and yesterday he kinda saved the internet. I called him up to talk about it! https://www.theatlantic.com/ ... [embedded post]
-
@censysio
@censysio
on x
Two critical PHP vulnerabilities. Widespread Internet exposure. Reuters covers the latest developments, citing Censys research. https://www.reuters.com/... Follow our Censys ARC advisory for the latest findings and updates: https://censys.com/... [image]
-
@cwarzel
Charlie Warzel
on x
70% of the internet was vulnerable yesterday to very bad security flaws inside a coding language. Turns out, *one volunteer* is mostly responsible for maintaining that code & helping push updates. Yesterday Ondřej Surý saved the internet. So I called him up. He rules. https://www…
-
@cwarzel
Charlie Warzel
on x
really exactly the kind of guy you want in charge of something like this
-
@czindublin
@czindublin
on x
🇨🇿 Hats off to Czech tech expert Ondřej Surý! 👏 As critical PHP vulnerabilities put websites worldwide at risk, Ondřej helped provide security updates for older PHP versions, protecting systems that still rely on them. An important reminder that the people working behind the scen…
-
@valerie.vg
@valerie.vg
on bluesky
“This is not because AI has become sentient [...] but because AI is proving something that we have always known: much of the software that runs the internet, our devices, our accounts, and our lives is vulnerable, or out of date, or has security flaws that human beings never noti…
-
@damonberes.com
Damon Beres
on bluesky
“I feel a responsibility toward the users of the internet. It would be a crazy day for me if I was on a boat in the middle of the Adriatic Sea. That could happen. But I had time to prepare the packages.” Hero.
-
@charles.littlegreenfootballs.com
Charles Johnson
on bluesky
Ondřej Surý has been an unsung hero of PHP for many years, and this is a fascinating interview. [embedded post]
-
@rincewind.run
Micah
on bluesky
literally this comic except he apparently lives in Czechia instead of Nebraska [embedded post]
-
@chemotaxis
@chemotaxis
on bluesky
holy shit this guy rocks and maybe is the patron saint of Operations [embedded post]
-
r/LabourUK
r
on reddit
Websites taken down worldwide as critical PHP cyber-security update issued
-
@josephfcox
Joseph Cox
on x
New: AI is making it so much easier to discover serious vulnerabilities. This applies both to people with little skill, and researchers with a lot of expertise. If you can't accept AI is exceptional at finding critical bugs, you're not living in reality https://www.404media.co/..…
-
@theatlantic
@theatlantic
on x
A major cybersecurity flaw imperiled 70 percent of the internet, @cwarzel reports. He spoke with the volunteer who helped fix it: https://www.theatlantic.com/ ...
-
@kiwix@mastodon.social
@kiwix@mastodon.social
on mastodon
A bit of follow-up on the PHP exploit-global emergency website update that's been in the news recently, and how bad it was: turns out most of the fix' deployment that saved the internet rested on a single, free-software volunteer. — https://www.theatlantic.com/ ... The XKCD la…
-
@jasonkoebler@mastodon.social
Jason Koebler
on mastodon
wrote about “Black October,” the PHP vulnerability, and the AI-fueled dread and panic I'm seeing among almost all of the cybersecurity experts I've ever known. — I think people w/ LLMs are brute forcing software the same way they brute forced social media w/ slop — https://ww…
-
r/technology
r
on reddit
The Man Who Saved the Internet Yesterday
-
r/neoliberal
r
on reddit
Websites taken down worldwide as critical PHP cyber-security update issued
-
@noahpinion
Noah Smith
on x
DESTROY THE INTERNET [embedded post]
-
@bayeslord
Bayes
on x
Millions of attempted exploits. I'm confused. Where is the impact? [embedded post]
-
@c_c_krebs
Chris Krebs
on x
[image] [embedded post]
-
@nikitabier
Nikita Bier
on x
There is nothing to worry about. Nothing important is run on PHP or old software—except the water & electrical grid, a few government services like our missile defense systems and a handful of electrified fences at the zoo (for the lions, tigers and cobras).
-
@redpillrabbit
@redpillrabbit
on x
THIS IS A WARNING TO EVERYONE. The ONLY REASON large companies aren't saying they've been hacked is BECAUSE THEY ARE TOO INCOMPETENT to know. They are staffed with INDIANS with FAKE CREDENTIALS. YOU ARE ALL FUCKED. [embedded post]
-
@citrini
@citrini
on x
I'm kind of worried that we are gonna have massive exploits like every other week [embedded post]
-
@bitcoinpalmer
@bitcoinpalmer
on x
Guys I know I meme and pasta a lot But I'm 100% struggling to see how this isn't a massive black swan otw [embedded post]
-
@dnvolz
Dustin Volz
on x
Fascinating. Amazon says it has telemetry showing PHP2Shell was being exploited on Oct. 17—that is, four days prior to public disclosure. Not known who was doing it. “It remains unclear how the actor acquired exploit information prior to disclosure.” https://aws.amazon.com/...
-
@ctrlaltdwayne
Dwayne
on x
Philomena: Some people have been writing PHP for over 20 years. Is that because it's particularly difficult to finish? Expert: No, software is constantly evolving. Philomena: So they've been writing the same website for 20 years? Expert: No, different projects. Philomena: Have th…
-
@mrsdeborahlynn
Deborah Lynn
on bluesky
www.reuters.com/world/asia-p... Millions of hacking attempts as companies and governments deployed patches and suspended websites as a precaution, according to cloud services firm Cloudfare. — Details of these flaws became public before fixes were ready. — #Blues
-
@bettycjung
Betty C. Jung
on bluesky
Millions of hacking attempts as companies, governments rush to patch PHP flaws www.reuters.com/world/asia-p...
-
r/PrepperIntel
r
on reddit
Millions of hacking attempts as companies, governments rush to patch PHP flaws
-
r/news
r
on reddit
Millions of hacking attempts as companies, governments rush to patch PHP flaws
-
r/worldnews
r
on reddit
Millions of hacking attempts as companies, governments rush to patch PHP flaws
-
@ollieatnowhere
Ollie Whitehouse
on x
At the @NCSC we are asking all UK organisations and their supply chains across product and services to understand their use of PHP and prepare to patch... https://www.ncsc.gov.uk/...
-
@vlad_mihalcea
Vlad Mihalcea
on x
Simplicity and flexibility always win. That's why PHP has a 80% market share of all Internet websites. https://w3techs.com/... [image]
-
@jacobshap
Jacob L. Shapiro
on x
I'm a little confused here Is the story, omg, AI can find vulnerabilities and hack all of our systems and the internet is dying Or, wow, AI can find vulnerabilities we didn't know of and help patch them quickly, making us all safer in the long run https://www.wired.com/...
-
@m_jones_1797
@m_jones_1797
on x
This is rather serious. About 70% of websites rely on PHP, which has been discovered to contain 2 major vulnerabilities. Cybersecurity specialists Cloudflare report thousands of attempts to exploit the vulnerability. Thankfully patches are available. https://www.ncsc.gov.uk/...
-
@danjarvismbe
Dan Jarvis MP
on x
Do you want more information about how to protect your organisation following the PHP advisory notice? The UK's cyber experts at @NCSC have published six key steps for organisations - large or small - to follow today. https://www.ncsc.gov.uk/...
-
@sporadica
@sporadica
on x
wait, if my math is correct.. doesn't this say that a full ONE THIRD of the Internet is just...perma-fucked?
-
@intcyberdigest
@intcyberdigest
on x
The day the internet broke, and most of it is too old to fix.
-
@ncsc
@ncsc
on x
The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated. For more⬇️ https://www.ncsc.gov.uk/...
-
@thorchrs
@thorchrs
on bluesky
👇🇬🇧"Minister says 32 UK government services unavailable due to global cyber-security issue" — #UnitedKingdom #PHPVulnerability
-
@mondoab
@mondoab
on bluesky
“The PHP Foundation has revealed two serious vulnerabilities that could impact millions of websites. Security experts warn that failure to quickly patch the flaws could have dire consequences.” — www.wired.com/story/this-i...
-
@charles.littlegreenfootballs.com
Charles Johnson
on bluesky
I spent most of the day upgrading and patching stuff on several sites. — ‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
-
r/BetterOffline
r
on reddit
Did LLMs' reward hacking behavior just cause a huge number of hours of cybersecurity labor to be expended for no good reason?
-
r/theprimeagen
r
on reddit
There isn't an easy exploit for this PHP vulnerability
-
r/wallstreetbets
r
on reddit
Critical security issue affecting PHP | National Cyber Security Centre
-
r/anime_titties
r
on reddit
PHP2Shell: AI uncovers critical RCE vulnerabilities affecting 70% of the Internet
-
r/ReverseEngineering
r
on reddit
There isn't an easy exploit for this PHP vulnerability
-
r/ItalyHardware
r
on reddit
Ma che è successo a mezzo internet oggi?
-
r/cybersecurity
r
on reddit
Wiz got pre-auth RCE on WordPress, Drupal and Joomla through vulnerabilities in PHP itself
-
r/GeminiAI
r
on reddit
Gemini 4 Argon credited for “invaluable contributions” to PHP2Shell vulnerability discovery
-
r/technology
r
on reddit
‘This Is Not a Drill’: Critical PHP Vulnerabilities Are Setting the Internet on Fire
-
@jeremy_kirk
Jeremy Kirk
on x
Wiz on PHP2Shell: “With frontier AI models and the right tools, a single researcher completed in a week what previously would have taken a world-class team months of work.” https://www.wiz.io/...
-
@eastdakota
Matthew Prince
on x
Cloudflare's Matthew Prince says PHP2Shell exploit attempts on its network rose from thousands in the 10 hours before the disclosure to millions afterward
-
@adriennelaf
Adrienne LaFrance
on bluesky
Help us Ondřej Surý, you're our only hope... www.theatlantic.com/technology/ 2...