Keeping this site safe and available for our community is something we take seriously. This week, we completed a planned security upgrade of the server that hosts this website, in response to critical vulnerabilities disclosed in an older version of PHP. We want to be transparent with you about what happened and what we did about it.

## What happened

Our site was running on a server image that included an outdated version of PHP. When new critical vulnerabilities affecting that PHP version were publicly disclosed, we took the hosting environment offline as a precaution while we carried out a full rebuild.

To be clear: we found **no evidence of any compromise or unauthorized access** to the site or its data during our review. This was a proactive mitigation, not a response to a breach.

## What we did about it

We didn’t patch the old server in place — we rebuilt the hosting environment from scratch to remove any doubt:

– **New server, modern software stack.** We stood up a brand-new server running a current, supported operating system, with an up-to-date, patched version of PHP and a modern web server and database stack.

– **Clean reinstall of site code.** Rather than carrying over the old application files, we deployed the site’s code fresh and only migrated the actual content — the database and media uploads — after inspecting it for signs of tampering.

– **Full credential rotation.** All administrative and service account passwords were rotated as part of the move, since the old ones had been stored in a way we were no longer comfortable with.

– **Tightened network access.** Access to the server is now restricted to only the traffic paths it actually needs, significantly reducing its exposure to the internet at large.

– **End-to-end encryption.** Traffic between visitors and our CDN, and between our CDN and the origin server, is encrypted and authenticated, closing off gaps that existed in the previous setup.

– **Backups and recovery.** Automated, encrypted daily backups with a defined retention window are now in place, along with off-server backup copies, so we can recover quickly if anything ever goes wrong in the future.

– **Decommissioning the old server.** The previous server was isolated from the network immediately and is being retained only briefly, in an offline state, for forensic reference before it is permanently destroyed.

## Leveraging AI in the response

To move quickly and reduce the chance of human error during a sensitive rebuild like this, we used an AI coding assistant (Claude Code) to help plan and carry out much of the migration — scripting the clean reinstall of the site software, orchestrating the data migration steps, and double-checking configuration changes such as access restrictions and encryption settings before they went live. Every step was reviewed and approved by our team before being applied; the AI acted as a careful pair of hands, not an autonomous decision-maker.

## Why we’re telling you this

We believe in being upfront with our community about how we handle security issues, even when — as in this case — nothing was actually compromised. Taking the extra time to rebuild rather than patch gave us much higher confidence in the integrity of the platform going forward.

If you have any questions about this update, feel free to reach out through our contact page.

Thank you for your continued trust and support.