Volunteer maintainer tells The Atlantic how PHP patches got out

Ondřej Surý, a volunteer who maintains PHP packages, described how he helped automate patch creation after two serious PHP vulnerabilities were disclosed in October 2026, in an interview with The Atlantic. Surý said he has worked on this for more than 20 years and that much of his work is automated.

According to the facts of the disclosure, exploitation of the vulnerabilities could let an attacker fully control servers, steal any data and take sites offline. The PHP project learned of the flaws beforehand, but information leaked onto an online forum before a patch was released, and the project moved its planned release forward by two days because of the leak. Cloudflare reported that exploitation attempts rose to millions after the vulnerabilities were disclosed.

Surý is not employed by the PHP project. His day job is director of DNS engineering at the nonprofit Internet Systems Consortium, and he is based in the Czech Republic. He said he does not personally run any PHP systems.

He said he has discussed a contingency plan with Raphaël Hertzog of the software company Freexian, and that he has received many small and some large donations since the previous day.

Security researchers found the vulnerabilities using an advanced OpenAI model, according to the facts of the case.