Well, that was a fun little internet apocalypse drill.
Two critical security flaws were disclosed in PHP, the software underneath Alacrity and a huge portion of the web. Both scored 9.2 out of 10 for severity. In vulnerable setups, an attacker could send a specially crafted request and make the server run their code without needing an account or password. That is very much a “drop everything and fix this” situation.Think of discovering that the front door can be persuaded to hand a stranger the keys. The dogs are excellent, but their cybersecurity qualifications are questionable.
This affects far more than our little corner of the internet. Compromised servers can expose data and become launching points for further attacks. That doesn’t mean the whole internet automatically falls over, but widespread unpatched systems make a genuinely serious mess possible.
We took Alacrity’s public web service offline while we worked. Because our server is old enough to have opinions about floppy disks, fixing it involved considerably more than clicking Update.
We built and deployed the patched PHP 8.4.27 runtime, upgraded Apache, adapted the legacy code, and checked more than 4,500 PHP and template files for compatibility. We tested login/session handling and key pages, disabled the old PHP web entry points, and brought the site back online for live testing.
The initial checks passed. Broader gameplay testing is still ongoing, so please report anything behaving strangely. This was emergency preventative work, not an announcement that player data was stolen.
The immediate vulnerabilities are patched. We’re continuing to watch for follow-up fixes and check the site. Hopefully the next emergency involves a dog eating something ridiculous rather than the internet eating itself. Posted by
Sin Vraal (#18687) on Oct 21, 2026
shywolf
what I'll end up doing is constructing an attribution system, and parts where we do use machine drawn, human artists can opt to replace it with hand drawn.