On October 21, 2026, the PHP project released versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 to fix two remote code execution vulnerabilities, referenced as CVE-2026-109618 and CVE-2026-109619.
Known as the « PHP2Shell » vulnerabilities, they carry a CVSS v4.0 score of 9.2 and could allow an unauthenticated attacker to execute code on a vulnerable server.
For many administrators, the update went through the hands of Ondřej Surý.
This Czech developer did not discover the flaws and did not author the initial patch. His work involves transforming the PHP source code into installable .deb packages for Debian and Ubuntu, which includes dependency management, installation scripts, configuration, and security updates.
Two widely used repositories
Ondřej Surý positions himself as the leading Debian PHP packager and maintains the packages published under the DEB.SURY.ORG label. He is one of the PHP package maintainers for Debian, alongside the “Debian PHP Maintainers” team and Lior Kaplan. He also operates two distribution channels: packages.sury.org for Debian and the Ubuntu PPA ondrej/php.
These repositories enable installing multiple PHP versions on a single machine and accessing newer releases than those provided by stable distributions. They also serve to backport fixes to branches that no longer receive official updates, such as PHP 7.4 or 8.0.
Backports for older branches
The PHP project no longer publishes official fixes for PHP 8.1 and earlier versions. It has provided source backports for certain legacy branches. Ondřej Surý has taken these fixes, incorporated them into his packages, and released them for all the branches he maintains, from PHP 5.6 up to 8.1.
Administrators affected thus did not have to recompile PHP or rebuild their environment: a standard APT update suffices. The changelog for the package php8.4 8.4.27-1~deb13u1, attributed to Ondřej Surý, explicitly mentions the two CVEs.
However, this approach has limits. Some very old configurations are not covered: PHP 7.2 on Ubuntu 20.04, for example, remains locked in its PPA and does not receive updates through this channel.
Ondřej Surý heads DNS engineering at the Internet Systems Consortium (ISC) and is associated with the development of BIND, the open-source DNS server. He chairs the IETF DNS Operations (dnsop) working group and is the author or co-author of several RFCs devoted to DNS and DNSSEC. On GitHub, he uses the handle oerdnj.
His activity as a PHP maintainer is voluntary and carried out alongside his role at ISC.
