Key Takeaways:
- Two critical PHP vulnerabilities — CVE-2026-109618 and CVE-2026-109619, dubbed “PHP2Shell” — were publicly disclosed on October 21, 2026 and rated 9.2/10 (Critical) in severity.
- PHP is used by approximately 69% of websites with identifiable server-side programming, making the scope of the threat enormous.
- PHP released fixes for versions 8.2, 8.3, 8.4, and 8.5 and urged administrators to update immediately — or take services offline.
- Games affected include Final Fantasy 14, Umamusume: Pretty Derby, Granblue Fantasy, Princess Connect! Re:Dive, Pokémon Sleep, Pokémon HOME, Pokémon Champions, Path of Titans, and more.
- One Japanese idle game, “Please Save My Pandemonium!”, permanently shut down because its decade-old codebase could not safely address the vulnerability.
- Most affected games have since returned to service; Path of Titans was still down as of writing.
- GOG and its launcher GOG Galaxy were also briefly taken offline as a precaution.
The internet had a rough week, and online gaming got caught directly in the crossfire. A pair of critical security vulnerabilities discovered in PHP — the programming language powering an estimated 69% of the world’s websites — triggered emergency maintenance and outages across dozens of services globally. From Square Enix to Cygames to The Pokémon Company, developers scrambled to patch their systems or take them offline entirely while fixes were distributed. Here’s a full breakdown of what happened and which games were hit.
What Is PHP2Shell — The Vulnerability Behind the Chaos
The vulnerabilities at the centre of this were formally identified as CVE-2026-109618 and CVE-2026-109619, collectively nicknamed PHP2Shell by the security community. Both received a CVSS v4.0 severity rating of 9.2 out of 10 — Critical. That’s about as serious as it gets in cybersecurity terms.
The two flaws relate to how PHP handles certain internal memory states during web requests:
- CVE-2026-109618 involves out-of-memory handling that can interrupt PHP while internal request data is only partially initialised, creating a window for exploitation.
- CVE-2026-109619 involves request-owned internal state that can survive after its associated memory has already been freed.
Critically, both vulnerabilities allow unauthenticated remote code execution — meaning an attacker who exploits them doesn’t need to already have access to your system. They can execute arbitrary commands on a vulnerable server from the outside. PHP released patches for versions 8.2, 8.3, 8.4, and 8.5 on October 21 and urged administrators to update immediately. For services that couldn’t apply the patch quickly, the recommendation was stark: take yourself offline until you can.
PHP is estimated to be used by roughly 69% of websites whose server-side programming language can be identified — which makes the potential scope of an unpatched vulnerability of this severity genuinely alarming. The gaming industry, particularly in Japan where PHP-based backend infrastructure is extremely common, took immediate action.
Final Fantasy 14 — Login Servers Taken Down
Square Enix moved quickly to protect Final Fantasy 14’s infrastructure. An official post to the FFXIV Lodestone website informed players that security enhancements were being applied to the MMO’s patch servers, and as a result, new logins were temporarily disabled across all worlds. Players who were already connected before maintenance began could continue playing — but anyone trying to log in during the maintenance window was locked out.
Logins have since been restored, but as of the time the source article was written, the server backup feature for user save data remains offline — still being brought fully back up. No exploitation of the vulnerability was confirmed at FFXIV during this period.
Umamusume: Pretty Derby and Cygames
Cygames took multiple of its titles offline in response to PHP2Shell, with Umamusume: Pretty Derby being the highest-profile casualty. Both Japanese and global servers for the popular horse racing gacha went down for emergency maintenance, with the developer assuring players that no exploitation had occurred. Upon returning to service, Cygames sent a compensatory package of in-game currency to all players as an apology for the disruption.
Granblue Fantasy and Princess Connect! Re:Dive — also Cygames titles — were similarly affected and went through emergency maintenance windows before being restored.
Pokémon Games Down Across Multiple Apps
The Pokémon Company found itself managing outages across several of its online services simultaneously. Pokémon Sleep, Pokémon HOME, and Pokémon Champions all entered emergency maintenance on October 21. Sleep players were met with a holding screen; Champions showed a pop-up warning that emergency maintenance was underway with no stated end time.
CHUNITHM’s international account also separately flagged the PHP vulnerability and announced its own emergency maintenance period in response. The breadth of the Pokémon outages reflects just how widely PHP infrastructure is used across The Pokémon Company’s online services — not just the main games.
Path of Titans — Still Down
The in-beta dinosaur survival MMO Path of Titans, from developer Alderon Games, announced via its official account that both the game and its website would be taken offline for up to three days as a precautionary measure. Players were assured that no data was compromised during the vulnerability window. As of the time of writing, Path of Titans remains offline — one of the longer disruptions of any game in this wave of maintenance.
GOG Also Went Down
Beyond the gaming services themselves, DRM-free game store GOG and its GOG Galaxy launcher were taken offline for a couple of hours on October 21 while the team applied security measures. In classic GOG fashion, the studio used the downtime as a light-hearted moment, posting when service was restored: “Your DRM-free library is right where you left it.” It was one of the more charming responses to a genuinely stressful industry-wide security event.
One Game Didn’t Make It Back
The most sobering outcome of PHP2Shell across the games industry belongs to a small Japanese idle RPG called Please Save My Pandemonium!, which had been running since 2011. Developer JAGS announced on October 21 that the game was permanently shutting down — not because of financial pressures or staffing issues, as is typical for a service shutdown, but specifically because their codebase was too old to safely address the vulnerability. Over a decade of operation, running on infrastructure that predates modern PHP security practices, left the team with no viable path forward. The shutdown was announced and executed the same day the vulnerability was disclosed.
It’s a particularly stark illustration of the threat PHP2Shell posed — not just to user data, but to the continued existence of services that simply couldn’t respond fast enough or whose underlying architecture made patching impossible.
The Bigger Picture
The gaming fallout from PHP2Shell is significant, but it’s worth emphasising that this was never a games-specific problem. The PHP vulnerability affected government agencies, e-commerce platforms, media organisations, and infrastructure providers across the globe. The gaming industry’s response was highly visible partly because outages for popular online games tend to generate immediate player reaction on social media, but the scale of the disruption was far broader than any single sector.
The fact that most affected games returned to service within hours — rather than days — reflects credit on the developers and backend engineers who moved fast under significant pressure. For the ones that are still working through restoration, or the one that didn’t survive it at all, PHP2Shell has been a stark reminder of just how much of the internet’s infrastructure rests on a single programming language, and what happens when that language has a critical flaw.
For more on the gaming industry this week, our coverage of Zenith: Nexus shutting down in December is another story about online games reaching their end — under very different circumstances. And for something more upbeat, Xbox Free Play Days this weekend has six games free to play right now while things return to normal.
