One Guy Saved the Internet This Week. That's the Problem.

PHP's emergency fix reached your server through one volunteer on Patreon. AI just made his job a lot harder.

8 min read

PHP's emergency fix reached old Debian and Ubuntu servers on Wednesday, October 21, thanks to a single volunteer. And that volunteer doesn't even use PHP.

His name is Ondřej Surý, and he maintains his repository in his free time lol

He maintains PHP packages in his damn free time!!! With donations from Patreon and PayPal. And he told The Atlantic that none of his own systems run PHP.

This man saved the internet. Literally.

And that's exactly the problem. Wednesday's bug, a critical flaw that let attackers run their own code on PHP servers remotely, was found by an AI, inside an OpenAI program called Patch the Planet (yes, really). Bugs now get found at machine speed, while the fixes still reach servers through a handful of volunteers. The day this one isn't around anymore, who does the job?

A lone superhero props up a cracking island of servers as robotic bugs swarm overhead and an office worker asks him to hold it longer.
Illustration generated with Codex.

The Tweet That Started "One Guy"

The phrase took off on October 21. Developer Ian Landsman tweeted that he was trying to explain to his wife how a single person handles PHP distribution for the entire world, and that if anything happened to that person, we'd all be cooked.

The next day, The Atlantic ran an interview with Surý, framed around the idea that he had more or less saved the internet.

Some of the thank-yous weren't even in English. A sysadmin on X, writing in Spanish, thanked Surý for patching PHP 5.6 and 7.4 and pulling people with Debian and Ubuntu servers out of trouble. Another, in Japanese, wrote that after updating a Debian 13 box, PHP 5.6 was covered, and credited people like Surý for holding the internet together.

It's "it works on my machine" in reverse: the fix works on yours, and he doesn't even run PHP on his.

To see why 1 person could matter that much, you have to look at what PHP actually shipped that day, and what it didn't.

What PHP Shipped vs. What Servers Got

On October 21, the PHP project released 8.5.12, 8.4.27, 8.3.36 and 8.2.35. Those are source code releases.

Your server doesn't install source code. It runs apt upgrade and installs packages, prebuilt versions that your Linux distribution knows how to drop into place. Somebody has to turn the source into those packages.

That step is the last mile. A security fix doesn't exist for a server until it lands in the package manager that server actually uses. The PHP project writes the fix. Packagers deliver it. And for versions PHP no longer supports, the packagers alone decide whether a fix exists at all.

For those older branches, the PHP security team stopped at minimal source backports for 7.4, 8.0 and 8.1, according to Unite.AI. Nothing below 7.4.

The same day, deb.sury.org shipped ready-to-install packages for the 4 supported branches plus 7 end-of-life ones: 8.1.34, 8.0.30, 7.4.33, 7.3.33, 7.2.34, 7.1.33 and 5.6.40, as Linux Compatible reported. One apt upgrade and you're patched.

Linux Compatible also notes that the PHP 5.6 package is on its 104th rebuild. An emergency backport to a branch this old only ships the same day because someone has kept that package alive, rebuild after rebuild, for years.

If you run PHP 7.3 on an old Debian box, there was no official fix to install on Wednesday. There was Surý's.

One caveat before anyone celebrates. A backport isn't the patch PHP itself wrote. It's someone else's adaptation of it, and it can change how things behave. Linux Compatible recommends reading the package changelog before you deploy.

The same day those packages went out, I'd published an article saying servers like these had no fix.

I Wrote "No Official Fix" the Same Day

On October 21, I put out a count of servers left with no official fix. The headline figure came from CybelAngel: 883,717 internet-facing hosts on PHP branches that would get no official patch.

I added a caveat that Debian, Ubuntu and Red Hat backport security fixes, so some of those hosts were actually fine. I never asked who does that backporting.

"Official" was the right word. But for old Debian and Ubuntu servers running Surý's repository, the fix that actually arrived didn't come from PHP or from the distribution. It came from a volunteer. "Official" told you who wouldn't ship the fix, not who actually would.

That same week, closer to home, my accounting software was down for 2 days and an e-commerce client got hacked.

Be careful not to overcorrect, though. Surý's repository covers Debian and Ubuntu. It doesn't cover Red Hat, Windows, or shared hosts that compile their own binaries. So no, he didn't personally save 883,717 servers.

Surý himself pushes back on the hero framing. He told the magazine that without him, people could have compiled PHP from other sources, just more slowly, and not everyone would have. He also shot down the rumor that a third of the internet was now broken for good, since the old versions can still be patched. And he's already preparing a handover with Raphaël Hertzog of Freexian.

So "one guy" overstates the breaking point. What it gets right is how few people the delivery layer rests on.

The Internet Runs on a Handful of Geeks

The Atlantic piece makes the point itself: Surý's work, along with that of a handful of others, is what let sites patch fast. That handful has a history.

Dotdeb. Dotdeb used to ship PHP packages for Debian. In January 2017, its maintainer described it as a one-man project that had been doing so for more than 14 years. He stopped supporting PHP 7.1 and later for personal and professional reasons, and pointed his users to deb.sury.org. The relay passed from one man working alone to another man working alone.

The language itself. In 2021, PHP contributor Joe Watkins put the language's bus factor (how many people would have to disappear for development to stall) at 2, according to The New Stack. That's the Sith Rule of Two applied to a programming language: always 2 there are, and if one walks away, you're down to 1. The PHP Foundation launched as Nikita Popov stepped away, to fund work on the core language. That fixed a real problem. It just didn't touch the packages your server installs.

OpenSSL. The year before Heartbleed hit in 2014, the OpenSSL Software Foundation had a single full-time developer and $2,000 in donations, MIT Technology Review reported. After the bug, the Linux Foundation launched the Core Infrastructure Initiative with more than $3 million in pledges.

xz-utils. Its creator described it as an unpaid hobby project, and he was its only maintainer. A contributor using the name Jia Tan spent 2 years building trust, until the backdoor CVE-2024-3094 (its public tracking ID), rated 10 out of 10 for severity, shipped in xz-utils 5.6.0, as The Stack reported. A lone volunteer maintainer is exactly the kind of door a patient attacker looks for.

Every crisis produced some money. None of them changed the shape. Critical infrastructure kept resting on 1 or 2 people, usually unpaid, until something broke or someone quit.

That shape has held since at least 2003. What changed this year is the speed at which the bugs show up.

AI Finds the Bugs. Volunteers Ship the Fixes.

Wednesday's bug was found by the security firm Calif using GPT-5.6 Sol inside OpenAI's Patch the Planet program, then independently by OpenAI and by Wiz. That's from Unite.AI, in a piece written by its AI research agent and reviewed by staff. I went through the full timeline in my October 21 article, so I won't redo it here.

OpenAI describes the moment as a "Defender's Window" and has committed $1 billion in subsidized access to its Daybreak product for defenders. Worth keeping in mind who's talking: OpenAI and Wiz sell models and security products, so the story where AI rides to the rescue is also their sales pitch. Earlier this year, the day AI bug-hunting knocked billions off security stocks showed how quickly discovery turns into a market.

Now look at the other end of the pipe. Surý's repository runs on Patreon and PayPal. His FAQ says he does the work entirely in his free time and owes his users nothing. According to the same interview, he received a year's worth of donations in 24 hours after the patch went out. Good for him. It also tells you what a normal year looks like.

That's the asymmetry. Finding bugs is getting industrialized, with a $1 billion program behind it and frontier models doing the hunting. Delivering fixes to old servers is still craft work, done by volunteers on donations. Discovery got a Death Star budget, and the last mile still runs on a tip jar.

And the 2 sides are linked. Every AI-found bug that also lives in the old branches means another manual backport, built and tested against versions the PHP project no longer patches. The faster discovery gets, the more work lands on the volunteers.

The researchers did their job: they found a real bug and reported it. The weak point is the system they feed.

The Last Mile Now Has a Price Tag

The deb.sury.org FAQ already points anyone running an end-of-life distribution to a paid option, built in collaboration with Surý's repository. The company behind it, Freexian, is also the handover Surý mentioned in the interview.

Surý doesn't romanticize it either. He told The Atlantic that open source can sometimes feel like exploitation, and that it will end badly if nothing changes.

An Argentine sysadmin summed up the other half on X: patching the infrastructure takes 5 minutes, but rewriting old code is impossible in the short term.

So the "who ships it?" question already has an answer, and it's called PHP LTS by Freexian. The last mile found its business model: the subscription. That's healthy, and it's probably what will let Surý hand over one day without his users holding their breath.

Except the Spanish sysadmin who thanked him on Wednesday doesn't run PHP 5.6 out of nostalgia. A server stays on a dead branch when nobody has the budget to rewrite what runs on it, and that budget won't show up for an LTS subscription.

Which leaves the question of who the delivery keeps covering once it has a price. Tonight, it still runs on a Patreon account.

Sources

When a critical PHP bug hits, the official fix reaches new servers fast. Old Debian and Ubuntu boxes may depend on one volunteer rebuilding packages in his spare time. The Demo vs Product Checklist in the kit helps you see whether your stack is actually vulnerable or only theoretically at risk.

→ Get the welcome kit

This post may contain affiliate links. If you click them, I might earn a small commission, costs you nothing, and helps me keep shipping quality articles every day for your reading pleasure.