THE VOLUNTEER WHO PATCHED PHP 5.6 WHEN NOBODY ELSE WOULD.

Summary from the TLDR InfoSec newsletter

When PHP2Shell broke, official releases stopped at 8.2. Ondřej Surý, who has packaged PHP for Debian and Ubuntu as a volunteer for 20 years, backported fixes all the way to 5.6 the same afternoon. Read how the leaked disclosure week unfolded [5]and why one maintainer carried so much of it. His backports rescued old branches once. If you run end-of-life PHP in production, HeroDevs NES for PHP [6]ships a supported fix for every CVE, with no code changes.