** Website Security Update - Critical Issue **

[Ted Craven]

Summary

PaceandCap.com website may soon experience downtime due to the need to (again) update the web software on which it runs. I will attempt this update over the coming week or more. There may be varying kinds of success, ranging from minimal (you don't notice anything) to severe (you can't access this website at all). I don't know which will happen until I start.

RDSS gets its user account validation (expiry dates) from our OTHER server (Artofpace.com / Rdss2.com / SartinMethodology.com) which is not affected in the same way, so RDSS itself should not encounter any issues.

Details
In the past several days you may have read in the news about numerous (millions) of websites around the world going offline due to a security bug discovered in a widely used older server language - PHP. This includes all WordPress and vBulletin based websites, which includes Paceandcap.com. The downtime is due to taking down websites to apply an update patch, test it, etc

We use an older version of both the vBulletin software and the PHP language which operates it. There is a patch available for PHP (new version 8.5.12) which addresses the security bug discovered (by OpenAI). Almost certainly, our older version of vBulletin (v3.8.11) will not work with the updated PHP version.

I have some alternatives in this case -

- find a retro-patched version of the PHP language version we use (v7.4) so we can keep using the vBulletin version we use, but with the newly released security updates

- apply the security patch, update our PHP but also migrate the entire P&C website including 20 years of all posts and attachments to a new version of either vBulletin or something else.

I already attempted this latter website migration in 2024 - a HUGE and somewhat expensive undertaking at the time behind the scenes which resulted in a VERY dissatisfying and slow new website (and new terrible look) which I eventually abandoned when I found another way to maintain the existing vBulletin and website intact.

I will be discovering what issues I need to deal with over the next few days. and post them here if this website is still accessible to the public. During this process I will also attempt the long-delayed plan to apply a secure website certificate (HTTPS) to the site to address the security issues of the existing legacy HTTP (not secure) access which you likely notice your browser complains about regularly.

Both me and my AI employee will be working overtime in the next while . My hope is that I don't need to do anything which might break the website until AFTER next weekend's Breeders' Cup events.

Thank you all in advance for your patience in whatever disruptions may (and may not) come.

Ted

[Ted Craven]

That was easier than I feared! The server host (MidPhase) confirmed they have applied the security patches to the older PHP version we are running, which permits our older vBulletin software to continue to run. So we should be covered.

Looks like business as usual - until the next security or software alarm.

Ted

P.S. Still - the website software needs to be updated and HTTPS applied. On the list ...

[dadams6357]

Good Job Ted

Don

[Bill Lyster]

For the last week, I have had to give me email, password, etc. EVERY time I access P&C. Is this because the site is not an https/ site. I also get messages that the site May not be secure.

Is this what you are talking about?