If you’re reading this right now, it means the internet is still working, and a huge crisis was averted…

Last week, two critical flaws in PHP, the programming language behind roughly 70% of websites whose server-side language is known, set off a global scramble to patch. Nicknamed PHP2Shell, the flaws let an attacker make a website's server run their own commands without logging in.

One of the people who did the most to contain the damage was someone you’ve never heard of: Ondřej Surý, a Czech volunteer who maintains widely used PHP packages in his spare time and had fixes ready, even for old versions of PHP, on the afternoon the official patch came out.

The two flaws, tracked as CVE-2026-109618 and CVE-2026-109619 and rated 9.2 out of 10 for severity, were found by researchers at Calif, OpenAI and Wiz with the help of AI. They sat in PHP itself rather than any one app, so websites built on WordPress, Drupal, Joomla and countless custom systems were exposed. The bugs affect PHP versions going back about two decades. Researchers estimated more than 1.3 million internet-facing servers were potentially vulnerable.

The PHP project planned a coordinated fix for 21 October, but technical details leaked a day early, and Amazon later found attempts to exploit the flaw dating back to 17 October. The UK's National Cyber Security Centre told organisations to update or take PHP offline.

There was a big problem, though: The PHP team released new versions only for the branches it still supports, PHP 8.2 to 8.5. Versions 8.1 and older are past their end of life, so they got no official patch, yet a large share of the world's servers still run them (some say as much as 70%), often on systems nobody wants to touch. And even where a fix exists, every server owner has to install it themselves.

"Think of it this way: someone discovered that millions of buildings in the country have the same broken lock, and now everyone knows how to open it," AI entrepreneur Matt Shumer wrote on X. "The lock maker has sent out a fix, but every building owner has to install it themselves, and many haven't yet."

That is where Surý came in: he maintains the PHP packages that a huge number of Debian and Ubuntu servers install from, so administrators can update with a single command instead of rebuilding PHP by hand. Because the PHP security team shared the fixes with packagers early, he had patched builds ready when the release went out, and he backported the fixes to old versions from PHP 5.6 onwards.

"The older branches took more work, but they can be patched, and people still run them," he said. His day job is director of domain-name engineering at the non-profit Internet Systems Consortium. For the PHP work, he is paid only in modest donations.

Reason compared Surý's role to the famous XKCD comic of modern digital infrastructure resting on one unpaid person's project, noting that this time the person lives in Czechia. HeroDevs traced the week hour by hour and how much of the internet's patching ran through his packages. Laravel Forge's advisory called his backports a stopgap rather than a long-term fix, and urged anyone on PHP 8.1 or older to move to a supported version.

The uncomfortable part of this story is the imbalance. AI tools helped find the flaws, and billions are pouring into AI research. The PHP Foundation, which looks after the language behind most of the web, has 13 full- and part-time staff and relies on donations.

A great deal of the actual rescue depended on one volunteer in Czechia having builds ready on time. It is the same pattern behind AI models finding real flaws this year: discovery is getting faster and cheaper, while fixing still depends on a handful of people.

For South African businesses, many of which run websites on PHP through shared hosting or WordPress, three steps are worth taking now. Ask your web host or developer which PHP version your site runs and whether it has been patched. If it is 8.1 or older, plan a move to a supported version, because a backported fix only buys time. And restart any long-running PHP processes after updating, since they keep running the old code until they do.

If your business depends on open-source software, consider paying something back. A donation to the people who maintain it is far cheaper than the next crisis.

You might also like our piece on the Ampath data breach, the RelyComply breach, and protecting your bank account.

Get more SA tech and business news and subscribe to The Open Letter.