The SuperTuxKart Team said on October 24, 2026, that users will need to set a new password when its online add-ons service returns. Separately, AWS recorded PHP2Shell exploit attempts before public disclosure, but said it could not determine whether they would have succeeded on real systems.
What AWS recorded before disclosure
AWS said its MadPot honeypot network recorded an attempt on October 17. It observed additional attempts from 02:00 to 08:00 UTC on October 21, before PHP announced the fixes at 14:00 UTC. AWS said the payloads and anonymized infrastructure varied, suggesting activity by multiple actors. AWS’s account of the MadPot observations describes attempts, not confirmed access to production systems.
Which PHP versions contain the fixes
PHP identified two runtime vulnerabilities: CVE-2026-109618, involving out-of-memory corruption, and CVE-2026-109619, involving stale request state. The project listed these fixed releases for their matching branches: PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP also notes that distribution vendors may backport fixes, so package users should follow their vendor’s security guidance. PHP’s security notices list the affected deployments, including PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed; PHP identifies mod_php as the configuration with the highest demonstrated risk.
Because the flaws are in the PHP runtime, updating WordPress alone does not replace fixing the PHP version serving the site. NeoTeo previously covered OpenAI’s reported role in identifying the PHP flaws.
What SuperTuxKart users should expect
In its October 24 update, the SuperTuxKart Team said the online add-ons service was offline and that it had no indication its server was breached. The team plans to require all users to set a new password when the service returns. Account migration depends on completing a rewrite and a security audit.
