SuperTuxKart has taken several online services offline, having pulled the server that powers them rather than risk it being exploited by PHP2shell.
The open-source karting game is not alone in ‘pitting’ to patch, with Wikimedia, DeviantArt, government websites and many more taking various systems offline to harden against it.
While offline, gamers can’t reset their online account passwords, check rankings or upload new add-ons. Offline components, like split-screen and LAN multiplayer, do work, as do online add-on downloads and online play, but only for registered users.
SuperTuxKart notes that attempts to exploit php2shell were recorded as early as 17 October, four days the flaw was publicly disclosed. Its own server was not breached, but suggests anyone reusing their SuperTuxKart Online password elsewhere, to change it there.
As legacy server ran an outdated version of PHP, but moving to a newer one would require changes to code more than a decade old. A security firm that reviewed parts of the code told the project not put it back online without rewriting it.
So that’s what it is is doing.
SuperTuxKart is rebuilding the server in Python, dropping PHP like a patch of in-game bubblegum. It won’t be using AI to write the code (a human would have to test, read and sign-off on the code to ensure they know what it does).
Bringing up the full feature set on the new server is expected to take many weeks of engineering, though it has been in development for several months – functional enough to keep online play and add-on downloads running for registered users.
But major gaps remain (like account creation), and it’ll need a security audit before any accounts move across.
Like so many open-source projects, SuperTukKart is reliant on volunteers. To help get its new server effort over the finish line, it’s launched a $4000 fundraiser. A security firm will match donations in engineering time.
Instagram Engineering
Shopify Engineering