The man who saved the internet yesterday
Archived — this story has rotated out of today’s deck. It is kept here in full.
The gist
Czech volunteer Ondřej Surý helped countless sites fix two PHP flaws used by roughly 70 percent of websites.
Much of the web rests on an unpaid volunteer's patch work.
Background
Ondřej Surý lives in Czechia and is director of domain-name-system engineering at the nonprofit Internet Systems Consortium; in a volunteer capacity he maintains and helps automate patches for PHP, compensated only by modest donations, and he does not work for the PHP Foundation. PHP is a programming language used by roughly 70 percent of websites, and the PHP Foundation is the organization that maintains it. The two vulnerabilities were discovered by cybersecurity researchers using a frontier model from OpenAI; if exploited, attackers could gain full control of servers, stealing or copying anything inside or simply taking sites offline. The foundation had recently learned of the flaws, but the disclosure leaked on a forum before a patch was released, setting off a race among the foundation, developers worldwide and attackers.
How it unfolded
- Oct 20, 2026The world found out about two massive security vulnerabilities in PHP, a language used by roughly 70 percent of websites, discovered by researchers using a frontier model from OpenAI.
- Oct 22, 2026Once the patch was released, websites everywhere went offline to implement the fix, including government sites in Germany and Finland, some hospital and school sites in Europe, and international sites such as 4chan.
- Oct 22, 2026An Anthropic top information security officer wrote that cybersecurity threats "are going to get a lot worse before they get better."
- Oct 23, 2026The Atlantic's Charlie Warzel identified Ondřej Surý as the volunteer whose work helped countless sites fix the vulnerabilities.
Who’s saying what
- Analysts
- Cloudflare CEO Matthew Prince said exploit attempts jumped from thousands in the 10 hours before the flaws were announced to millions now.
- Public
- A user in the PHP Subreddit wrote that "Ondřej will save the internet today."
- Expert
- An Anthropic top information security officer said cybersecurity threats "are going to get a lot worse before they get better."
- Analysts
- Matt Shumer, in a post on X, compared it to millions of buildings sharing one broken lock that every owner must now fix themselves.
Still unverified
Reason frames Surý as "the man who (maybe) saved the internet"; reports of autonomous agents operating inside bank accounts, though many of them may have been authorized by account holders.