SuperTuxKart reopens online sign-ups while it rewrites its old PHP server, with $950 of $4,000 raised

SuperTuxKart pulled its online services after PHP2Shell was disclosed on 21 October. Sign-ups are back from 7 November, the addons site is still down, and a rewrite needs funding.

AI-drafted from 4 sources. This story was written with AI from the outside reporting listed under Sources, and checked by automated tools before it went up. The originals have the full detail.

You can sign up for a SuperTuxKart Online account again. The open-source kart racer's fundraiser page lists 7 November as the day online registration came back, two and a half weeks after the team switched off the server behind its accounts, rankings, server list and addons site. The addons website is still down, and the page headline still reads "SuperTuxKart Online is offline for now".

Why it went dark

On 21 October the PHP project disclosed PHP2Shell, two critical remote code execution flaws. In its announcement the team explains that its server runs a PHP version that reached end of life years ago, and that the code on top of it would need major changes to run on a modern one. A cyber security association that had looked through parts of that code pro bono gave blunt advice: "Do not put this back online, it has to be rewritten."

The team says it was not hacked and has no sign the server was breached, even though attempts to exploit PHP2Shell were recorded from 17 October, before the flaws were public. OMG! Ubuntu reported that the project suggests changing your password anywhere else you used your SuperTuxKart Online one.

Single-player, split-screen and LAN races never stopped working, and addons approved before the shutdown can still be installed. A partly finished replacement server, written in Python, has already brought back some online services. The team calls the rest "weeks of engineering work, not a weekend project", and says the new code has to be audited before any existing account is moved across, then published once it is hardened.

The money

The goal is $4,000, with a stretch goal of $6,000. When we checked on 8 November the page showed $950 from 67 people, with 23 days left; the team updates the total by hand. The blog post says money received before the end of November goes to the missing features, fixes and a first audit pass, and that the security association is matching donations with engineering time. The page is frank about the budget: at the start of the campaign SuperTuxKart's Patreon was bringing in about $90 a month. You can give through Patreon, itch.io or a self-hosted BTCPay server, and all three come with preview tracks from SuperTuxKart Evolution, the project's next big update.

The first version of the page drew suspicion on Reddit, partly because parts of it had been made with AI tools. In a post on 6 November, lead developer Alayan confirmed the fundraiser is run by the official team, said the page sits on the project's own domain because the team put it there, and replaced it with one written entirely by hand. Alayan also pointed to SuperTuxKart's existing rule against AI-generated code contributions and said the new server code is held to the same standard as the game.

Sources

Image: Image: SuperTuxKart

More news from Gaming World