We don't know when it will be back.
TLDR: we were forced to take the addons website offline due to security risks. Work is ongoing on a rewrite, and we need your support. Join the fundraiser at: fund.supertuxkart.net ; every dollar counts.
 |
What happened?
On October 21st, the PHP project disclosed PHP2Shell (CVE-2026-109618 and CVE-2026-109619): two critical remote code execution flaws in every PHP version released since 2012. Governments took their websites offline. Wikimedia, the Internet Archive and thousands of others followed. So did we.
The difference is that most of them patched and came back within hours. We can't.
Why did we pull the plug?
The server behind SuperTuxKart Online (accounts, rankings, the server list, the add-ons repository) runs on a version of PHP that reached end of life years ago.
We could restore the forum quickly by updating to the newest PHP version, whereas getting the SuperTuxKart Online code to run on a modern PHP version would require major changes.
Worse, this code was written more than a decade ago by volunteers, for a different internet. Earlier this week, a cyber security firm went through parts of it pro bono. Their verdict on several things they found, was one sentence long:
Do not put this back online, it has to be rewritten.
With PHP2Shell now being actively exploited in the wild, that advice became an order. We were not hacked. We refused to wait around and find out. We will not gamble your accounts and data to keep a status screen green.
The harsh truth about the legacy online service
The server repository received a few dozen commits in the last five years. Several of them were bots bumping dependencies. This is what stands behind an online service used by thousands of players daily.
The world gave AI companies billions this year to find bugs like PHP2Shell. SuperTuxKart's entire budget for the month of October (Patreon + sales) is a bit less than 160 USD. We're not complaining. We're showing you the truth so nobody is surprised by what comes next.
Why can’t we just fix it?
A rewrite of the server in Python, built to modern security standards, was already underway and is partly working. This is what made it possible for us to restore partial API services to minimize disruption for SuperTuxKart players.
But this rewrite is not finished. Key functionalities are missing to bring back the full online services, some design decisions present in the original SuperTuxKart Addons have to be revised rather than mirrored, and it has to be audited before a single account is migrated. This is weeks of engineering work, not a weekend project.
Why not just have AI rewrite it?
AI tools can spot things humans skim past because they do not have the same time constraints when checking thousands of line of code. Using AI to assist with security audits is therefore a pragmatic choice we are willing to make.
But the ability to detect potential issues (false positives are very common) does not imply the ability to write well-designed code. Even if a model rewrote every line tonight, a human still has to test every endpoint, migrate everything safely, and sign off on the result before it touches your data. That human time is expensive and tokens aren't free either. AI "might" make the work faster. It does not make it free.
Trusting code that hasn't been properly tested and reviewed is a leap of faith we are not willing to make. See also our code contribution policy on AI. It explains why STK projects avoid AI code.
 |
Until the end of November every dollar we receive through every channel goes to this effort.
Our Python re-implementation of SuperTuxKart Online is still missing features essential to a basic online experience. Account creation and management are not possible, add-on uploads are not possible, and countless smaller pieces remain to be done. The implementation also reuses some logic from the original PHP code, which has to be replaced, and a security audit must be done before any of it goes live.
A cybersecurity firm closely tied to SuperTuxKart (one of our contributors works there and has already done pro bono work on this) is matching every dollar with an equal value of engineering. We have already invested USD 600 and received 12 hours of work instead of 6.
Our target is to raise USD 4,000. Doubled, that's roughly 80 hours: adding the missing features, fixing the issues identified, and the first audit pass. You can follow the effort at fund.supertuxkart.net, with regular updates.
Why is the source code of the new implementation not already public?
This is hard for us to say, but the new server's code will not be published until it has been hardened. AI has lowered the barrier to entry to uncover exploits, and an open source codebase can now be exploited within hours of release, before anyone has time to react.
Once the audit is complete, we will release the code, fully open source, as the legacy PHP version was.
What is currently missing?
The addons website is offline. All functionalities directly tied to it are unavailable: submitting a new addon or addon revision, resetting a forgotten password, checking online rankings, and more.
Importantly, the registration of new online accounts is also closed for the time being, as it isn't fully ready.
What still works?
Single-player, split-screen, LAN multiplayer. Contrary to what big publishers do, our game still works offline. You can also install addons that were submitted and approved before the addons website went dark.
Was my account compromised?
Exploitation attempts against PHP2Shell were recorded as early as October 17th, before public disclosure. We have no indication that our server was breached, but if your SuperTuxKart Online password is used anywhere else, change it there now (we strongly recommend you to use a password manager). We will force everyone to set a new password when our online service returns.
We'd rather be brutally honest than online and lying to you.
How can I help?
To contribute to our fundraising effort and help bring back full online services for SuperTuxKart sooner, the best way is to become a paid member on Patreon and make the project's funding more predictable.
You can follow the fundraiser's progress at fund.supertuxkart.net. One-time donation options are also available there.
Company or serious sponsor? Reach out to us.
Thank you for your support!
— The SuperTuxKart team
Posts
