SuperTuxKart rebuilds online server in Python after PHP2Shell threat forces shutdown

The open-source karting game SuperTuxKart has shut down several online services after the PHP2Shell vulnerability emerged, with exploitation attempts recorded as early as 17 October. Rather than risk its legacy PHP server being compromised, the project took the server offline entirely. The old codebase is more than a decade old and runs an outdated PHP version; a security firm advised against putting it back online without a full rewrite. SuperTuxKart is now rebuilding the server in Python, with enough functionality already deployed to maintain online play and add-on downloads for registered users. However, features like account creation, password resets, and rankings remain unavailable. The project has launched a $4,000 fundraiser to complete the work, with a security firm matching donations in engineering time.

What the PHP2Shell response changes for SuperTuxKart

• Legacy PHP stack abandoned: The original server ran an outdated PHP version with code more than a decade old, making patching infeasible; the project chose full rewrite over remediation.
• Python rewrite in progress: The new server is being built in Python from scratch, with human-written code explicitly required and no AI-generated code permitted without review and sign-off.
• Partial deployment already live: Registered users retain access to online multiplayer and add-on downloads through the new infrastructure, which has been under development for several months.
• Feature gaps remain: Account creation, password resets, leaderboard rankings, and new add-on uploads are disabled until the rewrite and a subsequent security audit are completed.
• Funded security audit planned: A $4,000 fundraiser is underway to complete the work, with a security firm matching donations in engineering hours and conducting the required pre-migration audit.

Why it matters

The incident highlights how volunteer-run open-source game projects with legacy infrastructure face acute security risks when upstream language vulnerabilities emerge, and how costly full rewrites become the only viable path. For Linux gamers and the broader FOSS gaming community, it demonstrates both the fragility of long-unmaintained server stacks and the feasibility of community-driven recovery through transparent fundraising and professional security partnerships.