The PHP2Shell fixes for Debian and Ubuntu, back to PHP 5.6, came out of a DNS engineer's side repo

“What a fun day to be alive and doing PHP packaging…” Ondřej Surý posted at 6 in the morning UTC on October 21, the day PHP2Shell’s fixes went out.

PHP2Shell is two bugs, CVE-2026-109618 and CVE-2026-109619, that “can let a single unauthenticated request run code on a server,” as DDEV’s write-up puts it. The PHP Foundation says an unauthenticated request can trigger the first one “before any application code runs” on Apache with mod_php. PHP itself shipped 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and every version older than that was left to whoever packages it for your distribution.

That somebody runs deb.sury.org. “I have been packaging PHP for Debian since PHP 5,” Surý writes there, which means “the official packages in Debian and Ubuntu are either my work or they are based on my work.” DDEV’s Stas Zhuk calls his the packages “that DDEV and much of the PHP world use,” and when DDEV checked around 16 UTC that day, deb.sury.org already had fixed packages for PHP 5.6 through 8.5 on Intel and AMD machines. The ARM64 builds came later.

He did the math in public that morning. Twelve PHP releases times six Debian and Ubuntu releases times three architectures came to “~216 builds,” he posted, and “It is even more for @freexian.” Freexian, which runs the PHP LTS repository with him, later counted “~500 builds covering all 12 supported PHP versions, 10 Debian/Ubuntu releases and up to 4 architectures,” rolled out over about 15 hours and finished by 1 AM CEST.

None of it is his job. ISC says Surý has been its Director of DNS Engineering since 2017, and that “independently of his day job, he is an important maintainer of PHP packages for Debian and Ubuntu.” (His Mastodon profile links to ISC’s BIND 9 GitLab, so the person patching your PHP has a DNS server project of his own to keep upright.) His own site says “I do this mostly in my free time” and asks businesses to buy Freexian’s commercial support or donate. The day after the fixes, he opened an OpenCollective “to see if I can replace my Patreon with that.”

He spent the attention handing out credit. “Real heroes are the upstream PHP engineers that prepared the fixes and coordinated the disclosure,” he wrote, and anyone making money on PHP “should also think about supporting” the PHP Foundation. When the thank-yous piled up, he pointed at Remi Collet, who does the RPM side: “my work would be much harder without his work.” Even the download traffic got a nod: “Kudos goes to @fastlydevs! The load on the origin server is just absolutely fine,” he replied.

Then the mainstream found him. Reason’s Eric Boehm credits The Atlantic’s Charlie Warzel with tracking him down, and the interview ran under a “saved the internet” headline. Surý’s review: “I can die in peace now, I have interview in The Atlantic ;).” Followed by “Yeah, yeah, the title is exaggerating.”

Building the packages and getting them installed are two different crowds. “I am worried about all these servers where someone did something in the past as a contractor and it is running unpatched PHP and unpatched WordPress ever since,” he wrote on fix day.

The next PHP2Shell-sized week will land on the same few people, and the pressure is already shifting toward paying them. The Foundation is now asking companies, hosting providers, distributions and governments for sponsorship, and Surý is test-driving OpenCollective in place of Patreon. Watch for the companies whose base images quietly install from ppa:ondrej/php to find that line in a Dockerfile during the next emergency, and for at least a few of them to put the repository on the same invoice list as their hosting afterward.

His OpenCollective page went up on October 22, and how full it is by the next emergency says more about the next PHP2Shell than any CVE score.