One Czech volunteer patches 70% of the web‘If Anything Happens to This Guy … Everyone Is Screwed’

After PHP disclosed a remote-code-execution flaw, an unpaid Czech engineer packaged the fix overnight and kept much of the internet standing.

Half the web went dark for a night

PHP underpins roughly 70% of websites. Last week it was found to have the most severe class of flaw: an attacker could run their own code on the server, steal data or take a site down.

Word of the flaw leaked onto a forum before a patch existed, and the attacks began. Cloudflare CEO Matthew Prince said exploit attempts jumped to tens of thousands in the 45 minutes after disclosure, hundreds of thousands within two hours, and millions now. Government sites in Germany and Finland, hospitals and schools in Europe, and 4chan all went offline to patch.

The patch came from a volunteer

One name kept surfacing on Reddit and X: Ondřej Surý. He lives in Czechia, does not work for the PHP Foundation, and his day job is director of DNS engineering at the Internet Systems Consortium.

His job is turning PHP's official source into packages people can install, and automating that across thousands of servers. Without him, many would have to compile it themselves — either unable to, or too slow.

He has done this for over 20 years, most of it automated, and runs no PHP himself, so he says the two days were not frantic. Everyone else was.

Donations equal one year

In 24 hours, contributions poured in equal to a full year's worth. By his account, nowhere near Silicon Valley money.

He is already discussing a handover with the company Freexian, so someone can step in if something happens to him.

He calls open source a form of exploitation: the companies that benefit most pay nothing, and eventually the people doing the work lose the will. This was a wake-up call, but he doubts much will change.

As for what ordinary people can do, his advice is blunt: trust the experts.