Looks like your site's version is affected. Might want to check it out when you have a minute!

Thanks for flagging this. Both CVEs are real: CVE-2026-109618 and CVE-2026-109619 ("PHP2Shell") are remote code execution bugs in how PHP recovers from out-of-memory and fatal errors. They affect PHP 5 through 8, and our website (forum, bug portal and the rest) was on PHP 7.4.33, which is end-of-life and has no official fixed release. As of 27 Oct 04:48 UTC the whole website runs on PHP 8.3.36, one of the patched releases (the wiki was already on it). Before switching we ran every page plus the forum and portal flows (sign-up, posting, reports with screenshots, comments, votes, edits, admin tools) on both versions against a copy of the real data, and they behaved the same. After switching, every page returned the same result as before. One side effect: everyone was logged out once, so please sign back in. If anything on the site or portal looks off, please file a Website report. Your second request (letting other players see the scrolling effect) is a game change, not a website one, so it has been passed on to the game side.

The scrolling part is fixed and live (build 20261027T064315Z): when someone scrolls an item, everyone on the map now sees the success or fail effect over that player, like in the original game. The PHP security part was handled separately (above).

The scrolling part is fixed and live (build 20261027T064315Z): when someone scrolls an item, everyone on the map now sees the success or fail effect over that player, like in the original game. The PHP security part was handled separately (see the earlier reply).