The main site was down for around two days, between Oct 21st 7:20AM UTC and Oct 23rd 3:30AM UTC. This update is to say that's resolved now, site is up and back to normal. All your data is here from the moment when we took it offline, and no data was lost. The rest of the post will be a technical writeup about what happened.


The site was originally taken down as a precaution. This was due to a critical RCE vulnerability in PHP that could allow for the site to be hacked if we left it online.

This was intentional by us, NOT a sign we were hacked. If we didn't shut off the website we would have been hacked, though, due to the severity of the exploit. The site was shut down before the RCE vulnerability was published, and we did not see / have no reason to believe there was any suspicious activity. Shutting down the site was recommended by the PHP developers at the time, and many other websites were also shut off to protect themselves.

https://cert.europa.eu/publications/security-advisories/2026-018

After shutting it down, we had to work to apply the security patch. This was difficult, because only the latest few versions of PHP 8 were supported, and we were still using older PHP. I thought about a few options (like adding a WAF to look for suspicious activity, or using unofficially backported patches), but I didn't trust anything that wasn't an official patch. So we decided to upgrade to PHP 8 instead. @Simon already started and did a majority of the work a while ago. I went and finished + tested all the changes. Others also tested, so thanks to everyone who helped me test the site as I worked through the upgrade.

PHP is not a compiled language, which makes it hard to find syntax errors and other bugs in the code. There were tons of bugs all over the site, and still could be. If you see any 500 errors or things not working as intended, post here in this thread or let me know what kind of problems you're getting.


Ultimately, the vulnerability was not our fault (it affected millions of websites), but the length of time to patch it was. I knew using an unsupported version would be trouble and should have tried the upgrade sooner, before it became an emergency. Going forward I'll try to keep it updated more often.

Ending off, here's some places you can look at for status updates if anything ever goes wrong:
Discord
Bluesky
Steam Community.
I posted updates on all 3 of those places, Discord will get you the most timely updates though.