How One Developer Saved the Internet from Critical PHP Vulnerabilities

Decades-Old Memory Flaws Leave Servers Exposed

The roots of the security failure extend back to 2004, when security researcher Stefan Esser discovered an early vulnerability related to PHP memory management. Another related bug was reported in 2020, and researchers spotted initial signs of the flaw during a security audit in 2024. However, researchers could not prove the flaw was exploitable at the time, and every proposed fix carried drawbacks. Because the PHP security team decides only by consensus, members remained divided for months, leaving the defect in the code. The PHP Foundation itself described the situation as a structural failure.

🚨 Critical #PHP2Shell vulnerabilities put millions of internet-facing assets at risk.Two critical flaws in the PHP core — CVE-2026-109618 and CVE-2026-109619 — can enable unauthenticated remote code execution and sensitive memory disclosure on vulnerable servers.As of… pic.twitter.com/qAAaquKaS8

— https://x.com/GroupIB/status/2113610672613535768

The PHP project originally planned to disclose the vulnerabilities publicly alongside an update on a Thursday. After information leaked in an online forum ahead of schedule, the project advanced the disclosure to Wednesday. Cloudflare executive Matthew Prince reported that his company observed thousands of attack attempts in the ten hours before the disclosure. Within forty-five minutes of the announcement, attack numbers jumped to tens of thousands, reached hundreds of thousands after two hours, and eventually scaled into the millions.

Global Emergency Patching Led by Volunteer Ondřej Surý

Before the updates arrived, operators across the globe temporarily took their websites offline to protect their systems. Government agency websites in Switzerland, Germany, and Finland were among those affected. Amid the scramble, online discussions repeatedly highlighted Ondřej Surý, a Czech resident who does not work for the PHP Foundation. Surý’s primary job is leading DNS development at the nonprofit Internet Systems Consortium. In his free time, he compiles ready-to-use packages from the PHP source code so administrators can secure thousands of servers with a single command, relying entirely on donations for this labor.

One developer shared on Reddit that they learned of the vulnerability at 2:00 a.m. and had completed updates by 3:00 a.m., noting that Surý had even provided fixes for the outdated PHP version 7.4. Der Entwickler Ian Landsman schrieb auf X, falls diesem einen Mann etwas passiere, dann wars das. All are screwed. Surý noted that he has performed this work for over twenty years with high automation, telling The Atlantic that the situation would have grown stressful only if I had been on a boat in the middle of the Adriatic. Without his packages, administrators would have had to compile PHP manually, delaying defenses and hindering those lacking the technical knowledge.

Donations Rise as Open Source Sustainability Questioned

The emergency patching process faced minor delays when the premature disclosure caused some compiled packages—including versions for ARM processors—to arrive hours late. Surý explained on Reddit that he is currently restructuring his infrastructure to handle such pressures. Following the crisis, donations increased significantly, with Surý noting that he received as much within twenty-four hours as he usually collects in an entire year. Nonetheless, he emphasized that the funds do not reach Silicon Valley levels. To ensure continuity if he becomes unavailable, Surý is discussing an arrangement with the software firm Freexian to take over his responsibilities.

Surý is not alone in providing this critical infrastructure support; users on Reddit noted that Frenchman Remi Collet performs equivalent work for Red Hat systems like CentOS and Alma Linux. Surý characterized the broader situation as a systemic issue, stating that open source sometimes feels like exploitation that primarily benefits corporations. Despite these structural challenges, he expressed hope that the crisis will prompt meaningful change, remarking that We cannot go on like this forever.

More on this story: Millions of Hacking Attempts Spark Global Scramble to Patch Critical PHP Vulnerabilities · OpenAI Says Its AI Models Helped Discover Critical PHP Flaws