MeanCEO: Tech Startups and Startup Ideas

Ondřej Surý: The Volunteer Who Shipped PHP2Shell Fixes for 12 PHP Versions. What Founders Owe the Open Source They Run On

TL;DR: Who is Ondřej Surý and why is everyone searching for him?

Ondřej Surý is the Czech engineer who, unpaid and in his spare time, builds the PHP packages that a great many Debian and Ubuntu web servers install. When the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) forced an early PHP release on 21 October 2026, his repository published fixed builds for 11 PHP branches the same afternoon and PHP 5.6 the next day, including old versions the PHP project no longer patches. The BBC told his story on 25 October, and he received more than $10,000 in a few days, about a year of donations. For founders, it's a hard look at who keeps your stack alive, and a cheap fix: find his packages on your servers, confirm the patched versions, and put your dependencies in the budget.
Searches for "Ondřej Surý" jumped by 500% in the UK on Sunday, passing 5,000, after BBC News called him an unsung hero of the internet. Most people who type his name had never heard it a week ago, and many of them have been running his work on their servers for years.
Here is what he did during the PHP2Shell week, why one volunteer sits under so much of the web, and six moves I'd make this week if your product runs on PHP.

Who is Ondřej Surý?

By day, Surý is director of DNS engineering at the Internet Systems Consortium (ISC), the US non-profit behind the BIND 9 DNS server. He has led BIND 9 development since joining ISC in September 2017, and before that he worked at CZ.NIC, the Czech domain registry, where he founded the lab that produced Knot DNS.
In his spare time he runs DEB.SURY.ORG. He has been a Debian Developer since 2000 and has packaged PHP for Debian since PHP 5, so the official PHP packages in Debian and Ubuntu are his work or built on it. His two repositories add something the operating systems don't: many PHP versions side by side, from PHP 5.6 to 8.5, on current Debian and Ubuntu releases.
  • ppa:ondrej/php, the Ubuntu PPA (Personal Package Archive).
  • packages.sury.org/php, the same packages for Debian.
Package means a ready-to-install bundle. The PHP project publishes source code, and someone has to compile it, test it and ship it so that a server owner can type one update command. For anyone using these repositories, that someone is Surý.

What did he do during the PHP2Shell week?

On 20 October php.net warned of an urgent security release. Details leaked online, the release came early on 21 October, and PHP shipped fixed versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 for two remote code execution flaws rated 9.2 on CVSS v4. We covered the release itself in our PHP vulnerability guide.
Surý had advance warning from the PHP project, as packagers do. The leak cut his preparation time, and he told the BBC he knew the problem was severe and time was short. Launchpad's own records show the result: fixed builds for PHP 7.0, 7.1, 7.2, 7.3, 7.4, 8.0, 8.1, 8.2, 8.3, 8.4 and 8.5 were published in his PPA at 14:45 UTC on 21 October, and PHP 5.6 followed at 13:38 UTC on 22 October.
Those old branches matter. The PHP project gives no official fixes for PHP 8.1 and older, only minimal source backports for 7.4, 8.0 and 8.1 on GitHub. Companies stuck on legacy PHP got installable patches anyway, from one volunteer.
PHP branchOfficial PHP statusPatched build in ppa:ondrej/php
8.5, 8.4, 8.3, 8.2Supported; fixed in 8.5.12, 8.4.27, 8.3.36, 8.2.35Same versions, 21 Oct, 14:45 UTC
8.1, 8.0, 7.4End of life; source backports only8.1.34-9, 8.0.30-25, 7.4.33-31, 21 Oct
7.3, 7.2, 7.1, 7.0End of life; no fixBackported builds, 21 Oct
5.6End of life; no fix5.6.40-105, 22 Oct, 13:38 UTC
Then the thanks arrived. Surý told the BBC he received more than $10,000 (£7,470) in a few days, about what he used to collect in a whole year. He also pointed at the PHP project's own people, who he feels got too little of the credit.

Why does so much of the web depend on one volunteer?

PHP runs about 70% of websites whose server language is known. Each Debian or Ubuntu release ships one default PHP version, while WordPress plugins, Laravel apps and Magento shops each want their own.Surý's repositories install any branch from 5.6 to 8.5 side by side, which is why so many teams add them on day one and forget they're there. His PPA alone has created 52,327 builds over the years.
His GitHub Sponsors page shows how thin the money is. On 26 October it listed 349 current sponsors and a goal of $15,000 a month, which he says would let him work on open source full time. The page showed 9% of that goal, roughly $1,350 a month by my calculation.
He was blunt about it with the BBC. Big technology companies should take more responsibility for the open source they rely on, he said: "If you just take and don't give back then it will backfire."
There's a second warning in the interview. Asked whether most of the responsibility rests with him, he agreed. Colleagues at Freexian, the Debian services company he works with, could take over, but they don't yet have his accumulated experience. And he expects more of these weeks: AI is speeding up how fast vulnerabilities get found, by attackers and defenders, so teams should be ready to patch this quickly again soon. We saw the same pattern in Claude Mythos 5's malicious pull request and in OpenAI's sandbox red team.

What should founders who run PHP do now?

If your product, website or client projects run on PHP, here are six moves for this week. The first two take ten minutes.
  1. Find his packages on your servers. On each Ubuntu or Debian machine, run grep -r "ondrej\|sury" /etc/apt/sources.list /etc/apt/sources.list.d/. Any hit means you install PHP from his repository. Version strings from it contain deb.sury.org, so dpkg -l | grep php shows it too.
  2. Confirm you got the 21 October builds. Run php -v and compare with the table above: 8.2.35, 8.3.36, 8.4.27 or 8.5.12 on supported branches, or the package versions listed for older ones. Restart PHP-FPM or Apache afterwards, because a running process keeps the old code until it restarts. Our PHP issue explainer covers what to do if you can't patch.
  3. Treat old PHP as borrowed time. Backported builds for 7.x and 8.1 kept you safe this week. Check PHP's supported versions: 8.2 gets security fixes only until 31 December 2026, so plan the upgrade to 8.3 or newer now, while the incident still has everyone's attention.
  4. Watch the PPA move. Surý's PPA page says the repository is being merged into packages.sury.org. Jammy and Noble can keep using the PPA for now, Ubuntu Resolute should use packages.sury.org, and he promises migration steps for older releases. Put a reminder in your ops calendar so updates don't quietly stop arriving.
  5. Put your dependencies in the budget. List the ten open-source projects your revenue depends on and find their funding pages. Surý's own tiers start at $10 a month for companies under 5 people and $50 for under 10. If your business needs guaranteed security updates, he asks companies to buy commercial support: Freexian's PHP LTS starts at 1,200 euros a year for up to 30 systems.
  6. Name your fallback. For each dependency maintained by one person, write down what happens if they stop: your distribution's own PHP packages, a commercial long-term support vendor, or an upgrade path. That single line in your security notes is cheaper than discovering the answer during the next leak.
Want the wider basics? Our security guide for startups sets up patching and accounts from day one, and the Rank Math PRO malware case shows the other side of trusting someone else's package. If you don't touch servers yourself, Fe/male Switch has a plain-language PHP checklist for small businesses to send your developer or host. We track the month's incidents in cybersecurity news for October 2026.
Are you getting customers from ChatGPT yet?

More and more traffic is coming from Perplexity, ChatGPT, Grok and other AI tools.

👉 Rank on ChatGPT

What does this say about open source and startups?

Every bootstrapped founder I know runs on free software, and almost none of us pay for it. That's fine until the week a leak puts the whole web on a deadline, and the fix for your server depends on whether one person in Czechia is free that afternoon.
The donations of the past week show people want to give back, and they also show how unplanned it is: a year of money arriving in days, because a news story went viral. A $10 monthly sponsorship from a five-person startup is a rounding error in your tool budget. Multiply it across the companies that run his packages and his $15,000 goal, the amount he says would let him work on open source full time, stops looking far away. I'd rather pay that small, boring amount every month than rely on luck during the next PHP2Shell.

FAQ: Ondřej Surý and the PHP packages

Who is Ondřej Surý?

A Czech engineer and Debian Developer who maintains PHP packages for Debian and Ubuntu in his spare time through DEB.SURY.ORG, including the popular ppa:ondrej/php. His day job is director of DNS engineering at the Internet Systems Consortium, where he leads BIND 9 development.

Why is Ondřej Surý trending?

On 25 October 2026 BBC News told how he, unpaid, packaged the PHP2Shell security fixes for Debian and Ubuntu users during the week of the leak, including old PHP versions the PHP project no longer patches. Searches for his name rose 500% in the UK.

Is ppa:ondrej/php safe to use?

It's run by the same person who maintains the official Debian PHP packaging, and its packages match the official Debian packaging, according to DEB.SURY.ORG. Launchpad labels every PPA as unsupported by Ubuntu, so businesses that need guaranteed security support can buy Freexian's PHP LTS.

Which PHP versions got the PHP2Shell fix in his repository?

Launchpad shows fixed builds for PHP 7.0 to 8.5 published on 21 October 2026 at 14:45 UTC, and PHP 5.6 on 22 October. Officially, only PHP 8.2, 8.3, 8.4 and 8.5 received fixed releases.

How much money did Ondřej Surý receive?

He told the BBC he received more than $10,000 (£7,470) in donations in a few days, about a year's worth of his usual contributions. His GitHub Sponsors page showed 349 sponsors and 9% of a $15,000 monthly goal on 26 October.

How can a startup support the PHP packages it uses?

Sponsor him on GitHub (company tiers start at $10 a month for teams under 5 people), donate through OpenCollective, or buy commercial support through Freexian's PHP LTS, which starts at 1,200 euros a year for up to 30 systems.

About the Author

Violetta Bonenkamp, also known as MeanCEO, is an experienced startup founder with an impressive educational background including an MBA and four other higher education degrees. She has over 20 years of work experience across multiple countries, including 5 years as a solopreneur and serial entrepreneur. Throughout her startup experience she has applied for multiple startup grants at the EU level, in the Netherlands and Malta, and her startups received quite a few of those. She’s been living, studying and working in many countries around the globe and her extensive multicultural experience has influenced her immensely.
2026-10-26 07:23 News and Trends