PHP2Shell forced us to pull the plug on a server we can't patch and can't safely restart. For the next 30 days, every dollar we receive goes to the rewrite and audit, and is matched with an equal value of engineering work.
Company or serious sponsor? Reach out to us and we'll talk directly.
The bar is not scaled to our goal. It's scaled to what one software engineer costs for one month. Our Patreon which we only opened a few months ago, brings in about USD 90 a month. That is the budget that was supposed to keep an online service for thousands of players secure. It isn't enough, and pretending otherwise is how we got here.
On 21 October the PHP project disclosed PHP2Shell: two critical remote code execution flaws in every PHP version since 2012. Our server ran on a version that reached end of life years ago. No patch exists for it. Earlier this year a security firm reviewed the code pro bono. Their verdict:
We were not hacked. We refused to wait around and find out. We will not gamble your accounts to keep a status screen green.
A security firm closely tied to SuperTuxKart matches each donation with an equal value of engineering work. We tested it: USD 500 bought 10 hours, not 5.
Everything except online. Single-player, split-screen, LAN multiplayer and the add-ons you already have installed. The game is fine. The cloud behind it isn't.
If your STK password lives anywhere else, change it there now. Everyone sets a new password when online returns.