The PHP2Shell Story & The Man Who Keeps PHP Running

The details leaked before the fixes were out. Attackers were probing for the bug days before anyone announced it. And the coordinated disclosure that was meant to give everyone a fair head start came apart in public, with the PHP project and a security vendor trading blame over who released what, and when. 

The stakes were hard to overstate. PHP powers roughly 70% of websites whose server side language is known, from WordPress blogs to Drupal government portals to e commerce stores. Researchers estimated more than 1.3 million internet-facing hosts were potentially vulnerable. Amazon logged exploit attempts four days before disclosure, Cloudflare saw attacks emerging, and the UK's National Cyber Security Centre told organizations to update or take PHP offline. 

Security teams everywhere were asking the same questions. Are we exposed? Is there a patch? Can we even install it on the old servers nobody wants to touch? 

For a very large part of the internet, the answer to that last question came down to one volunteer working from the Czech Republic: Ondřej Surý. 

This is his story, and the story of how the PHP2Shell week actually unfolded. 

‍

Twenty years of quiet work 

For more than two decades, Ondřej has taken PHP's source code and turned it into ready to-install packages for Debian and Ubuntu, published through deb.sury.org. System administrators add his repository, run apt upgrade , and get a current, secure PHP without compiling anything. Across fleets of hundreds or thousands of servers, that difference is the difference between patching in minutes and patching in weeks. 

None of this is his day job. Ondřej is Director of DNS Engineering at the nonprofit Internet Systems Consortium, the home of BIND 9, and lives in the Czech Republic. He isn't employed by the PHP project. His open-source PHP repositories are volunteer work, much of it automated over the years, and supported by donations through GitHub Sponsors. 

‍

How the PHP2Shell week unfolded 

Researchers at Calif, OpenAI and Wiz found two flaws in PHP's core, tracked as CVE 2026-109618 and CVE-2026-109619 and rated 9.2 on CVSS v4. Together they let an attacker run code on a server through a crafted request. The PHP project planned a coordinated release, and Linux distributions and packagers, Ondřej among them, got the patches early. Then the plan fell apart. 

‍

By then, estimates put more than 1.3 million internet-facing hosts at risk. Ondřej later said that having the fixes in advance is what kept the work manageable. He didn't panic. He treated it as a problem to solve. Patching the versions nobody else would 

The official fixes covered PHP 8.2 through 8.5. Branches 7.4 to 8.1 got only minimal source backports from PHP's security team, and 5.4 through 7.3 got nothing at all. Yet the vulnerable code path dates back to PHP 5.4, and plenty of production servers still run those versions. 

Ondřej shipped fixes for them anyway. His repository published backported builds for PHP 8.1, 8.0, 7.4, 7.3, 7.2, 7.1 and 5.6 alongside the supported releases, with changelogs noting "Backported from 8.2.35." One administrator summed up the reaction on X: against all odds and with no warning, Ondřej had patched PHP 5.6 and 7.4, and saved everyone running Debian and Ubuntu servers. 

When a claim went around that a third of the internet was now permanently broken, Ondřej pushed back. Older versions can be patched, he said. He had just done it. 

‍

One person, a lot of weight 

The week made something uncomfortable plain: software under much of the web rests on a few people, often unpaid. Ondřej has said he wants a fairer arrangement, where the companies that benefit most help pay the maintainers they depend on. He's also planning ahead, and has discussed succession with Raphaël Hertzog of Freexian, a partner in the PHPLTS project, so the work can continue, no matter what happens.

"Because the PHP security team shared the fixes with packagers ahead of time, I had builds ready when the release went out, even after the date moved. The older branches took more work, but they can be patched, and people still run them, so I patched them. What I'd like to see come out of this is more companies helping to sustain the maintainers they rely on, before the next emergency rather than after it." 

— Ondřej Surý, maintainer of deb.sury.org 

"Most people running PHP have never heard Ondřej's name, and that's exactly how good infrastructure works: invisible until the moment it matters. This month it mattered, and he was ready. The open source world owes him a thank-you, and more than that, it owes him support. That's why HeroDevs backs open source maintainers. Our business depends on the work they do, and when the next incident hits, the internet will once again be counting on people like Ondřej. " 

— Rob Nalen, COO, HeroDevs, Inc. 

PHP2Shell won't be the last incident like this. In a post-Mythos world, AI models can find decade-old bugs in foundational software faster than ever, and the people looking for them won't all be defenders. Disclosure windows will get shorter, leaks will be more common, and the burden will keep landing on the small number of maintainers and packagers who turn a fix into something the world can actually install. 

That's why HeroDevs is proud to support the communities and maintainers at the heart of open source, and why we believe that support has to be in place before the next crisis, not scrambled together during it. Through the Open Source Sustainability Fund, HeroDevs is a Featured sponsor of Ondřej. If your organization runs PHP on Debian or Ubuntu, you can sponsor him on GitHub too. 

If your organization is running legacy PHP and requires support, HeroDevs Never-Ending Support (NES) for PHP delivers ongoing security fixes for end-of-life PHP versions.