Who keeps the internet running, and what happens when they can no longer afford to? An expert explains

When two critical security flaws in PHP, a programming language used by millions of websites, prompted organisations around the world to take services offline in October, Czech software engineer Ondřej Surý was among the maintainers who helped get the fixes to users.

The flaws, collectively dubbed PHP2Shell, led to precautionary shutdowns on October 21 of services run by Japan’s Finance Ministry, US human-resources platform BambooHR, the Port of Rotterdam in the Netherlands, and the Wikimedia Foundation, which operates Wikipedia.

Surý maintains widely used PHP software packages for Debian and Ubuntu, two Linux-based operating systems. He made patched versions available even for older releases of PHP that no longer receive official security updates.

Surý does much of this maintenance alongside his full-time job as Director of DNS Engineering at the Internet Systems Consortium (ISC), which develops software that helps translate website addresses into the numerical addresses computers use to communicate over the internet. He told The Indian Express that ISC had seen a sharp spike in vulnerability reports this year, although relatively few were serious. As AI tools make it easier to identify potential security flaws, assessing and fixing them still requires human expertise.

The experience raises a larger question about the sustainability of open-source software, whose underlying code is freely available for others to use, modify and distribute, and on which much of the internet depends. In an interview with The Indian Express, Surý discusses the PHP2Shell incident, the growing demands of AI-assisted vulnerability discovery, and why he believes businesses that profit from open-source software must help fund its maintenance. Edited excerpts:

Why does PHP matter to the functioning of the internet, and what made the recent PHP2Shell vulnerabilities particularly serious?

PHP is a programming language mainly used to develop websites. Roughly 70% of the web is powered by PHP. The recently discovered vulnerabilities in PHP were in the most serious category, remote code execution (RCE). In short, an attacker can exploit such a vulnerability to execute a program of their own choosing on a remote machine, potentially gaining full access to the server (the computer running the website or service).

When researchers discover a serious security flaw in widely used software, what happens next? Who develops the fix, who ensures it reaches users, and which parts of this process still depend heavily on human work?

Story continues below this ad

When ethical security researchers discover a serious security flaw, they contact the affected project or organisation privately. Any project or organisation that cares about security should have a mechanism through which researchers can report flaws in its software.

Fixing the vulnerability is usually no different from fixing any other defect in the software, but the process depends on the size of the project. The work could fall to a single person in a small project or a handful of people in a larger one. They might or might not be employed to do this work.

In the case of PHP, there are a handful of volunteers for whom this is a side project, and very few people are employed directly by the PHP Foundation. Most of the important work still depends on people. As for when and how AI is used, it is important to remember that AI is just a tool that might or might not be useful in specific cases.

How did the early disclosure of the PHP2Shell vulnerabilities affect the release of security updates?

Story continues below this ad

That was unfortunate because people who knew the original release schedule had made plans to properly release the software so that users could upgrade. The premature disclosure accelerated the whole process by a day.

Now, this is the bad part about AI: once details of the upcoming vulnerabilities were known, people started using AI to search for possible security flaws. It was no longer safe to stick to the original schedule because AI, as a tool, is quite good at finding security vulnerabilities, especially when guided by a skilled person.

AI tools are increasingly being used to discover vulnerabilities in software. Have you noticed any change in the number or complexity of vulnerability reports you receive, or in the work required to respond to them?

In my day job, I am the Director of DNS Engineering at ISC, responsible for BIND 9, a widely used open-source DNS server. There was a sharp spike this year in the frequency and depth of the vulnerability reports we received.

Story continues below this ad

Fortunately, after the initial surge, things went back to normal. We still receive occasional security reports, but only very few of them are serious enough to be handled as security vulnerabilities.

That is the thing with AI: it needs to be guided by an expert with domain knowledge. Otherwise, you often end up with serious-sounding reports about ordinary software bugs, or issues that are not even bugs.

Could AI also help maintainers identify security vulnerabilities themselves?

Not only that, maintainers can also use frontier AI models to find security vulnerabilities themselves. That said, both offensive (finding and exploiting vulnerabilities) and defensive (finding and fixing vulnerabilities) uses of AI need to be supervised by an expert. Otherwise, you might end up with a pile of mediocre-quality reports or, worse, AI might miss something serious.

You’ve spoken about the difficulty of sustaining open-source maintenance. Why does so much essential software depend on the work of relatively few people, and what would it take to support them adequately?

Story continues below this ad

When I joined university in 1995, free software was still very new, at least to me, and I found a purpose in making the fruits of my work freely available to others. It was a paradigm change, and I believe many people involved in the free-software movement are still driven by those ideals.

On the other hand, some people have built multibillion-dollar enterprises on top of open-source software and never even thought about supporting the software that allowed them to make money.

I think we need to find a balance. The free-software model is viable because it gives me and other developers freedom. On the other hand, if many people depend on that software for their livelihoods, we need a sustainable model that allows maintainers to continue working on the software they love without becoming exploited and exhausted.

Who should be responsible for funding the maintenance of open-source software?

Story continues below this ad

That question can easily be turned around: if the people maintaining the open-source software your company uses were to simply walk away, how large would your losses be in the event of a serious security vulnerability like the recent one in PHP? This should give people running businesses the answer to who should fund the work.

Not every open-source project has an organisation, whether for-profit or non-profit, behind it, but some do.

For instance, Software in the Public Interest is a non-profit organisation that provides financial and administrative support to projects such as Debian. Smaller projects can raise funds through platforms such as Open Collective, while PHP development receives funding through the PHP Foundation.

My PHP packaging work can be supported through Freexian’s PHP Long Term Support (PHP LTS) project, which provides maintenance and security updates for older PHP releases, or through GitHub Sponsors, which allows individuals and organisations to fund developers directly.

Story continues below this ad

At my day job, the Internet Systems Consortium (ISC) offers paid professional support for open-source projects such as BIND 9 and Kea, among other projects I am closely associated with.