Ondrej Surý, the man who saved the internet: ‘You have to want to do something for others’

The unassuming Czech engineer Ondrej Surý, 49, has 273 followers on the social network Mastodon. He also has a Patreon page where 490 people contribute €1,539 ($1,724) a month. There he describes himself in these rather technical terms: “I am the main Debian packager for PHP and other packages under DEB.SURY.ORG name.” Behind those obscure software concepts lies volunteer work that recently helped save millions of websites.

Hundreds of social media messages publicly thanked him for his work and newspaper headlines called him an unsung hero. But Surý, speaking to EL PAÍS in a video interview from Tuscany, where he was on vacation last week, has the expression typical of a friendly programmer, not one given to either praise or grandstanding. “I’ve been doing this for a long time; for me it’s normal,” he says.

Was it really that important? Yes. Surý made life much easier for thousands of developers who otherwise would have had to work long hours. In August, two U.S. security firms discovered two vulnerabilities in PHP, the programming language used on 70% of the world’s websites. Before a patch was released, details of the vulnerabilities leaked. Attackers could exploit them to alter websites, steal customer data, whether current or future, or even gain access to other computers. Within hours, dozens of agencies and politicians issued immediate update alerts.

Surý packaged the patched code so it could be installed quickly and, crucially, adapted it for older versions of PHP. This story offers two major lessons. First, even in 2026, the internet still depends on the goodwill of people who maintain open-source software in their spare time. “The sooner people realize that software must be maintained, the safer we’ll be,” Surý says.

And second, AI is accelerating the discovery of vulnerabilities and, with it, increasing the workload of these volunteers. A graph created with the help of AI by a programmer known as 0xosprey tracks vulnerabilities recorded in the official Common Vulnerabilities and Exposures (CVE) database and illustrates their rapid growth. The trend helps explain recent warnings from concerned policymakers, such as U.K. Defence Secretary Wes Streeting, who last week urged Britons to stockpile food and water at home in preparation for the multiple crises facing the world, including cyberattacks.

Is it really true that thousands of volunteers are maintaining the pillars of the internet?

It’s absolutely true,” says Courtney Miller, a professor at George Washington University. “Open-source software is a movement sustained by volunteers. Many companies benefit from it, but ultimately much of it is led by individuals. Often a single person maintains a project.”

Because they are volunteers, it is common for them to stop working on projects for reasons such as changing jobs, losing interest, or simply running out of time. It is a peculiar additional risk in the modern world.

The internet is more than a network. It’s an incredible jumble of small parts that communicate with each other. Each is vital in its own way. Among programmers, a cartoon by Randall Munroe, a former NASA robotics engineer and creator of the xkcd webcomic, has become popular and has since been adapted to reflect Surý’s work.

“Every piece of digital infrastructure rests on open-source components,” says Daniel Stenberg, the Swedish developer who created and has maintained curl, a data-transfer tool found on billions of devices, for decades. “Anyone who creates software knows this. The lack of foresight and the ‘we’re not obliged to pay, so we don’t’ mentality is what makes the worst situations repeat themselves,” Stenberg adds, pointing at companies that exploit the situation.

This time it was PHP, but it is not going to stop there. “There are hundreds of programs in the same situation,” says Michael Schwartz, chief technology officer at Censys, a cybersecurity firm that continuously scans the whole internet. “They are like important car parts from different manufacturers that only a small group of volunteers maintains. If a defect in a part allowed someone to open or take control of a car, millions of vehicles would be at risk, regardless of brand,” Schwartz explains.

The issue with Surý is not that he does work that nobody else could do. Rather, his experience and expertise allow him to do it very easily. “I’ve been doing this for a long time; it’s my day-to-day work,” he says.

If someone else had to step in, they would need to invest significant time in learning how. The Czech engineer sees that as the main challenge: “When I started with free software, it felt fresh, new and exciting. I’m not sure new generations will keep seeing it that way.”

We live in a different world, adds Surý: “Now everything has sped up: the internet moves much faster. We have AI. Perhaps young people feel overwhelmed by the number of things they can choose from. It requires a certain mindset: wanting to do something for others.”

Other candidates could take over responsibility for all this software: governments and companies. Neither solution is ideal. The hope is that new regulation will hold companies accountable for proprietary software they release and then fail to maintain.

“The problem is responsibility. We’ve gotten used to all these devices having flaws, to it being normal that software has bugs. But I don’t think that’s acceptable. Companies that make money from commercial products have to be held accountable,” Surý says, adding that “they should help fund” the free open-source software projects they rely on, Stenberg adds.

More vulnerabilities ahead

This fragility, combined with the rise of AI, creates a new challenge. It is true that AI can accelerate attacks, but it can also improve defences. There will be a constant cat-and-mouse game at a pace that may be increasingly difficult for so few people to sustain.

“Vulnerability research has always been tedious,” says Schwartz. “New AI tools speed up that process exponentially, so it’s reasonable to expect more vulnerabilities to appear. It’s like an arms race: everything improves, but it does so for both defenders and attackers.”

At its core, this means additional work for those responsible for monitoring and maintaining software.

“It’s very possible we’ll see more crises like this,” says Jesús María González Barahona, professor of Telematics Engineering at Madrid’s Rey Juan Carlos University. “The probability that this happens on a large scale with widely used components is not zero. It could happen that a vulnerability is detected that someone can exploit very quickly and cause problems in critical infrastructure. It’s a known issue in the community, and more resources should be devoted to it, both from companies and public funds.”

Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition