Game News

A PHP security flaw knocks games offline across Japan: who went dark, and for how long

Two critical flaws in PHP, the language that runs many web servers, sent games and online services into emergency maintenance on 21 October. Dexerto reported that the bugs, CVE-2026-109618 and CVE-2026-109619, were rated 9.2 out of 10 and can allow unauthenticated remote code execution. PHP released patched versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35 the same day.

Japan was hit hardest. Gigazine listed the maintenance windows: Uma Musume Pretty Derby and Granblue Fantasy went down around 10pm local time and Pokémon Sleep from 11pm, alongside non-game services such as pixiv, Niconico and BOOK☆WALKER. Dexerto added Pokémon HOME, Pokémon Champions, Shadowverse: Worlds Beyond, Princess Connect! Re:Dive, CHUNITHM and Nintendo Switch online services, while noting that Nintendo had not confirmed a link to PHP.

“Currently no end time has been given for the maintenance” — Serebii, via Dexerto

South Korea's Gamemeca followed the responses: Square Enix suspended Final Fantasy XIV's patch servers, leaving players unable to log in; Sega put a product site into maintenance; and a web game called World Quest shut down for good, saying its system was too old to defend. Eurogamer also listed Final Fantasy 14 and Umamusume among the titles hit.

How each outlet framed it

• Gigazine — a timetable of which Japanese services went down and when.
• Dexerto — the technical risk, and the long list of Pokémon and Nintendo services in maintenance.
• Gamemeca — how individual publishers reacted, from inspections to a permanent shutdown.
• Eurogamer — the global picture for players, led by Final Fantasy 14.

What we don't know yet: Gamemeca said no game hacking incidents exploiting the flaws had been reported so far.