7 hours ago
Yesterday (Wednesday 21st of October 2026), the forum and SuperTuxKart addons website (where players can manage their STK account, submit addons, etc.) were taken down preemptively after the PHP Foundation gave advance notice of a critical security vulnerability present in all versions of PHP allowing unauthenticated remote code execution.
PHP is a server-side programming language commonly used to create dynamic internet websites. Both the forum and SuperTuxKart addons use it.
After the security patches were released, and once the early rush to grab the update which bogged down PHP servers subsided, we updated the PHP version in use to a patched version that's protected against the exploit.
The forum was put back online this morning. No further disruption is expected.
The addons website remain currently (Thursday 22nd of October, 18:30 UTC) unavailable. Its code doesn't support newer PHP versions out of the box. The API allowing core in-game functionality has been restored through a safe service that doesn't rely on PHP. We are currently working on a solution to restore the website safely.
PHP is a server-side programming language commonly used to create dynamic internet websites. Both the forum and SuperTuxKart addons use it.
After the security patches were released, and once the early rush to grab the update which bogged down PHP servers subsided, we updated the PHP version in use to a patched version that's protected against the exploit.
The forum was put back online this morning. No further disruption is expected.
The addons website remain currently (Thursday 22nd of October, 18:30 UTC) unavailable. Its code doesn't support newer PHP versions out of the box. The API allowing core in-game functionality has been restored through a safe service that doesn't rely on PHP. We are currently working on a solution to restore the website safely.