We don't know when it will be back.
TLDR: we were forced to take the addons website offline due to security risks. Work is ongoing on a rewrite, and we need your support. Join the fundraiser at: fund.supertuxkart.net ; every dollar counts.
 |
What happened?
On October 21st, the PHP project disclosed PHP2Shell (CVE-2026-109618 and CVE-2026-109619): two critical remote code execution flaws in every PHP version released since 2012. Governments took their websites offline. Wikimedia, the Internet Archive and thousands of others followed. So did we.
The difference is that most of them patched and came back within hours. We can't.
Why did we pull the plug?
The server behind SuperTuxKart Online (accounts, rankings, the server list, the add-ons repository) runs on a version of PHP that reached end of life years ago.
We could restore the forum quickly by updating to the newest PHP version, whereas getting the SuperTuxKart Online code to run on a modern PHP version would require major changes.
Worse, this code was written more than a decade ago by volunteers, for a different internet. Earlier this week, a cybersecurity association went through parts of it pro bono. Their verdict on several things they found, was one sentence long:
Do not put this back online, it has to be rewritten.
With PHP2Shell now being actively exploited in the wild, that advice became an order. We were not hacked. We refused to wait around and find out. We will not gamble your accounts and data to keep a status screen green.
The harsh truth about the legacy online service
The server repository received a few dozen commits in the last five years. Several of them were bots bumping dependencies. This is what stands behind an online service used by thousands of players daily.
The world gave AI companies billions this year to find bugs like PHP2Shell. SuperTuxKart's entire budget for the month of October (Patreon + sales) is a bit less than 160 USD. We're not complaining. We're showing you the truth so nobody is surprised by what comes next.
Why can’t we just fix it?
A rewrite of the server in Python, built to modern security standards, was already underway and is partly working. This is what made it possible for us to restore partial API services to minimize disruption for SuperTuxKart players.
But this rewrite is not finished. Key functionalities are missing to bring back the full online services, some design decisions present in the original SuperTuxKart Addons have to be revised rather than mirrored, and it has to be audited before a single account is migrated. This is weeks of engineering work, not a weekend project.
Why not just have AI rewrite it?
AI tools can spot things humans skim past because they do not have the same time constraints when checking thousands of line of code. Using AI to assist with security audits is therefore a pragmatic choice we are willing to make.
But the ability to detect potential issues (false positives are very common) does not imply the ability to write well-designed code. Even if a model rewrote every line tonight, a human still would have to test every endpoint, migrate everything safely, and sign off on the result before it touches your data. That human time is expensive and tokens aren't free either. AI "might" make the work faster. It does not make it free.
Trusting code that hasn't been properly tested and reviewed is a leap of faith we are not willing to make. See also our code contribution policy on AI. It explains why STK projects avoid AI code.
 |
Until the end of November every dollar we receive through every channel goes to this effort.
Our Python re-implementation of SuperTuxKart Online is still missing features essential to a basic online experience. Account creation and management are not possible, add-on uploads are not possible, and countless smaller pieces remain to be done. The implementation also reuses some logic from the original PHP code, which has to be replaced, and a security audit must be done before any of it goes live.
A cybersecurity association closely tied to SuperTuxKart (one of our contributors works there and has already done pro bono work on this) is matching every dollar with an equal value of engineering. We have already invested USD 600 and received 12 hours of work instead of 6.
Our target is to raise USD 4,000. Doubled, that's roughly 80 hours: adding the missing features, fixing the issues identified, and the first audit pass. You can follow the effort at fund.supertuxkart.net, with regular updates.
Why is the source code of the new implementation not already public?
This is hard for us to say, but the new server's code will not be published until it has been hardened. AI has lowered the barrier to entry to uncover exploits, and an open source codebase can now be exploited within hours of release, before anyone has time to react.
Once the audit is complete, we will release the code, fully open source, as the legacy PHP version was.
What is currently missing?
The addons website is offline. All functionalities directly tied to it are unavailable: submitting a new addon or addon revision, resetting a forgotten password, checking online rankings, and more.
Importantly, the registration of new online accounts is also closed for the time being, as it isn't fully ready.
What still works?
Single-player, split-screen, LAN multiplayer. Contrary to what big publishers do, our game still works offline. You can also install addons that were submitted and approved before the addons website went dark.
Was my account compromised?
Exploitation attempts against PHP2Shell were recorded as early as October 17th, before public disclosure. We have no indication that our server was breached, but if your SuperTuxKart Online password is used anywhere else, change it there now (we strongly recommend you to use a password manager). We will force everyone to set a new password when our online service returns.
We'd rather be brutally honest than online and lying to you.
How can I help?
To contribute to our fundraising effort and help bring back full online services for SuperTuxKart sooner, the best way is to become a paid member on Patreon and make the project's funding more predictable.
You can follow the fundraiser's progress at fund.supertuxkart.net. One-time donation options are also available there.
Company or serious sponsor? Reach out to us.
Thank you for your support!
— The SuperTuxKart team
Posts
Somehow some STK online servers are working partially, so maybe can be possible to host the next races of STK Enduro tournament, but i will find a way to host if I can't use the online servers
ReplyDeleteSee this part of the article:
Delete"A rewrite of the server in Python, built to modern security standards, was already underway and is partly working. This is what made it possible for us to restore partial API services to minimize disruption for SuperTuxKart players."
This is what allows addon downloads to still work, as well as online-play for already-registered users.
The rewrite was in an advanced enough state to serve as a partial replacement, but work on it started many months ago, and now we need to add several key features quickly to be able to restore full service, plus do a proper security check on the new code.
Ok so :)
DeleteWhat old PHP version were you running? 5.4? A PHP2Shell fix for 5.4 can be found here: https://repo.calcforge.org/temp/php-5.4.16-cve-2026-109618-109619.patch
ReplyDeleteIt wasn't as old as that (PHP 5.4 is a dinosaur), it was on PHP 7.4.
DeleteHowever, as explained on our funding page: "We could get the stk-addons service back up quickly by using a third-party backport of PHP. The rest of the code is a bigger problem. It's so outdated that it won't run on a modern PHP version without major changes."
After this incident prompted us to look at it closer, we do not have confidence in the safety of the addons code itself. Updating it to run on a modern PHP version and to address its biggest issues would be a major undertaking (not to mention the technical debt it carries), so focusing work instead to finish the Python reimplementation that was already in the works simply makes more sense.
Given the no-AI policy, it's confusing why the donation page is very obviously vibe-coded. The donation page even mentions a statement on Patreon at the bottom - but there isn't one! This is incredibly off-putting. I first found out about this due to a discussion on r/linux_gaming about whether or not this is a scam as a result of how it all looks, however having looked into it further myself it appears to be very real but just a generally poorly thought out.
ReplyDeleteYou've already got a funding page that could've been linked to, and whipping up some sort of tracker to add there would've probably made more sense. It's disappointing to see you guys resort to vibe-coding something like that...
Please see the explanations given at: https://www.reddit.com/r/linux_gaming/comments/1xpni0z/about_supertuxkarts_fundraiser/
DeleteThe fundraiser is not something that we planned long in advance. Circumstances happened, and while we wrote the text (as we always do in all our articles), and made design decisions about what should be in there, the html template of the initial funding page had indeed been AI-generated. For a static html page, all the key concerns about maintainability, reliability, licensing, and reviewing effort are not really applicable, and at the time it seemed sound to have the time used to help restore services rather than to design html.
Given the reactions to the original page and the doubts it created, though, our online services admin took two evenings to work on a new 100% human-made page to replace the old one. Again, see the link given above for details.
P.S.: The delay in approving the comments was just a matter of checking them, with many things to do, we only check frequently soon after a new post has been published.
Asking for $4000 via a vibecoded site, despite Super Tux Kart's anti-ai policy, right after the php exploit? It seems like you have been hacked or are being coerced.
ReplyDeleteSuperTuxKart has not been hacked or coerced. The fundraising is perfectly legitimate, see my answer to hogsy above as well as the Reddit thread I linked in that comment for more details.
DeleteNote to current readers: the fundraising page was redesigned following those negative reactions, the page visible currently at fund.supertuxkart.net is fully human-made. I don't think the old version was that bad in isolation (we wrote the text, the information contained was correct, we decided what should be in there and tweaked visual elements too), but at a time where there is so much AI-generated spam, it raised trust issues. And of course, for a fundraiser, trusting that it's legitimate and that the team will use it carefully is crucial.
I don't have any money to give, but I wish STK the best of luck.
ReplyDeleteEven if the community can be a pain in the arse sometimes, the game's in a tough spot right now, and it needs all the luck it can get.
I also love the no-bullcrap, straight-to-the-point nature of this article (and, tbh, most of the articles that I've read here). Thank you for being honest and doing what's in the best interest for STK's playerbase; it's not something that most people can take for granted.
Happy races! :}
If you don't have much to give, we completely understand. Thank you for your support anyway!
DeleteWe prefer being direct and honest about things, it's nice to hear that it's appreciated.