CyberWorld MMORPG: Development Log May 2026

CyberWorld has been running in some form since early development, but May 2026 marks the first period where we'd call the platform genuinely stable and feature-complete enough to describe publicly. This is a developer log, not a press release.

What CyberWorld Actually Is

CyberWorld is a browser-based multiplayer environment with a cyberpunk aesthetic. It combines:

• Terminal-based game mechanics: Missions executed through simulated command-line interfaces
• Real security education: Challenges based on actual techniques — OSINT tasks, CTF-style puzzles, network analysis exercises
• Hosted tools: Access to legitimate security tools within the game environment
• Realtime multiplayer: Players share the same operational environment, can see each other's activity, collaborate on missions
• Progression system: Experience, rank, and unlocked capabilities tied to completed challenges

The game is at /cyberworld.

Technical Architecture

Stack

• Frontend: Next.js 15 with TypeScript, deployed on Cloudflare
• Database: Supabase (PostgreSQL) with Row Level Security for multi-tenant player data
• Realtime: Supabase Realtime for live game state synchronization
• Auth: Supabase Auth with JWT-based session management
• Terminal emulation: Custom xterm.js implementation with sandboxed command execution

The Terminal Sandbox

Players interact with the game through a terminal interface that looks and feels like a real shell. Commands need to execute, but we can't give players actual shell access.

The solution: a command interpreter that maps game commands to game state mutations, with a syntax that mirrors real tools:

// Example: player runs 'nmap' against a game target
const commandHandlers: CommandMap = {
  nmap: async (args, gameState) => {
    const target = parseNmapTarget(args);
    if (!gameState.hasTargetInScope(target)) {
      return errorOutput('Target out of scope. Check your mission briefing.');
    }
    const scanResult = await gameState.performScan(target, parseNmapFlags(args));
    return formatNmapOutput(scanResult);
  },
  // ... 40+ commands
};

Realtime Game State

const channel = supabase.channel(`zone:${zoneId}`)
  .on('postgres_changes', {
    event: '*',
    schema: 'game',
    table: 'zone_state',
    filter: `zone_id=eq.${zoneId}`
  }, handleZoneUpdate)
  .subscribe();

Current Feature Status

| Feature | Status | |---------|--------| | Terminal interface | Live | | Basic missions (L1-L5) | Live | | OSINT missions | Live | | Multiplayer zones | Live | | Player progression | Live | | Inventory / loadout | In development | | Advanced missions (L6-L10) | In development | | Guild / team system | Planned | | Custom mission builder | Planned | | Mobile interface | Planned |

The Security Education Layer

What separates CyberWorld from other hacking games is that the underlying techniques are real. When a player does an OSINT mission, they're using real OSINT methodology — the game just provides the target and validates the result.

We track which MITRE ATT&CK techniques each mission covers and display that to players. The goal: players who complete the full mission tree understand the adversary lifecycle from initial access through exfiltration.

What's Next

The L6-L10 mission tier is the current development focus. These missions are more complex, involve multi-stage objectives, and require players to chain techniques together. Think advanced persistent threat simulation rather than individual technique exercises.

If you're interested in contributing missions, the repo has contribution guidelines. If you just want to play, /cyberworld is the door.