“The feeling is like I am responsible for all these people and I can’t fail them,” Ondřej Surý told BBC News, capturing the intense pressure of a global cybersecurity scramble. Surý, who has voluntarily maintained software for Debian and Ubuntu Linux for more than two decades, dropped everything to convert crucial PHP security fixes into easily installable packages after AI-identified flaws triggered a race against time across the internet.
Ondřej Surý and the Unsung Infrastructure of the Web
For more than 20 years, Surý has quietly helped keep websites running securely in his spare time. He voluntarily maintains software for two of the most popular versions of Linux, a free operating system similar to Windows that runs heavily on web servers. His primary task involves keeping these systems up-to-date with the latest versions of PHP, a programming language underpinning a significant share of the world’s websites. While this critical work sounds like a full-time occupation, Surý actually works as the director of DNS engineering at Internet Systems Consortium, a US non-profit organisation. In his own time, he takes source code released by the PHP project and turns it into packages that website operators can install without deep technical expertise.
A Race Against Time After AI-Driven Vulnerability Discovery
This week brought a level of urgency when artificial intelligence helped identify two major cybersecurity flaws in PHP, prompting the PHP Foundation to release critical fixes. Surý had received advanced warning from the PHP project, but when details regarding the weaknesses leaked online, the planned release schedule was accelerated. “I got aware that this is quite severe and I don’t have that much time to prepare the packaging of the PHP that I provide to people,” Surý told BBC News. Despite the sudden compression of his schedule, his extensive experience allowed him to prepare and distribute the patches alongside other developers worldwide who were racing to secure the internet’s essential infrastructure.
Donations Surge Amid Calls for Corporate Responsibility
The intense crisis prompted an immediate wave of financial support from people and entities relying on his software packages. Surý revealed that he received more than $10,000 (£7,470) in donations over just a few days, representing roughly a year’s worth of previous contributions. However, he emphasized that major technology companies must assume greater responsibility for supporting the open-source software they heavily depend upon. “I think they should be more responsible,” Surý said, adding that taking without giving back ultimately backfires. He also noted that while colleagues at software company Freexian could theoretically take over his maintenance duties if necessary, they currently lack his accumulated experience, leaving a massive weight of responsibility squarely on his shoulders.
Who Is Ondřej Surý and How Do Donations Compare?
What is Ondřej Surý’s day job?
Surý works as the director of DNS engineering at Internet Systems Consortium, a US non-profit organisation, while maintaining Linux software packages in his spare time.
How much did donations increase during the security incident?
Surý received more than $10,000 (£7,470) in donations within just a few days of the crisis, matching about a year’s worth of contributions he had previously received.
Which Linux distributions does Surý support?
He voluntarily maintains software packages for Debian and Ubuntu, two of the most popular versions of Linux used on web servers.