As a precaution, the main site (https://powdertoy.co.uk) has been taken down. This is due to a critical RCE vulnerability in PHP that could allow for the site to be hacked if we left it online.
This is intentional by us, not a sign anything was hacked or anything. If we didn't shut off the website we would have been hacked, though. All of your saves and other tpt data are still safe. The site was shut down on Oct 21st, before the RCE vulnerability was published.
Shutting down the site was recommended by the PHP developers at the time, and many other websites were / are affected today and have also shut off to protect themselves.
https://cert.europa.eu/publications/security-advisories/2026-018
We're working on upgrading the site to patch the issue. We have to upgrade to PHP 8, it's causing a ton of bugs but we'll work through it. It could take a few days to get the site working again. Once it's ready, we'll rebuild the docker containers and bring the site up.