Two critical PHP flaws, fixed on 21 October 2026, sent Cygames, SEGA, Square Enix, Bushiroad and other Japanese companies into emergency maintenance over the following 48 hours. Most services were back within about two days, but Arc System Works suspended all its web services on 23 October, and two long-running games on old server stacks closed for good rather than migrate.
Two remote code execution flaws
PHP’s maintainers gave a day’s warning on 20 October, saying two vulnerabilities rated 9.2 on CVSS v4.0 would be fixed at 14:00 UTC on 21 October. The security advisory lists CVE-2026-109618, memory corruption after out-of-memory handling, and CVE-2026-109619, request state that survives into a later request on the same worker. Both can lead to remote code execution. Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP-FPM, Apache mod_php, php-cgi, FrankenPHP and LiteSpeed are all affected. The project says the risk is highest with mod_php, where a demonstrated exploit needs no login and fires before any application code runs. PHP 8.1 and older no longer get official updates, although minimal backports are linked for source builds.
Japan’s Information-technology Promotion Agency (IPA) asked operators to prepare before the release. It warned that attackers might move within a very short time, and told organisations to look for PHP hidden inside products and for unsupported versions still in use. IPA said it had not confirmed any attacks.
Which games and services went offline
From about 23:00 JST on 21 October, Cygames put Umamusume: Pretty Derby, Granblue Fantasy and Shadowverse: Worlds Beyond into emergency maintenance, and Heaven Burns Red, Dolphin Wave and SEGA’s CHUNITHM-NET followed, Game*Spark reported. The Shadowverse: Worlds Beyond team said it had found no damage or data leak. By 23 October, 4Gamer’s roundup also listed Square Enix Members and its support centre, a pause on new Final Fantasy XIV logins, Bushiroad’s group sites and the cancellation of some card-game tournaments, and Sony’s Japanese store. It also listed platform-wide maintenance at DMM GAMES, while noting that DMM did not name PHP as the cause.
SEGA’s notice is typical. Its product information site went fully offline at 22:55 on 21 October, citing the PHP vulnerability, and reopened at 11:30 on 23 October after the affected components were fixed, while some individual game sites stayed under checks. SEGA said it had found no damage from unauthorised access. Most services were restored within about two days, but not all: on 23 October Arc System Works announced additional maintenance that suspended all of its websites and web services, with no end time given, 4Gamer reports. When we tried its Japanese site on 25 October, it still returned a service-unavailable error.
Two games that closed instead of migrating
For two long-running titles, the patch was the end. The travel game World Quest announced on 21 October that it would close the same day, writing that “because of the old system, we cannot take sufficient measures” and that it was closing to protect players’ information, J-CAST News reported. On 22 October the idle RPG Boku no Makai wo Sukutte! (僕の魔界を救って！), running for more than ten years, said dealing with the serious PHP vulnerability had become too difficult, and that moving the OS and PHP to a new environment was not realistic, according to 4Gamer and J-CAST.
What separated quick fixes from closures
None of the notices we could read reported a breach. The cost came from preparedness. Teams that knew where PHP ran in their stack, and were on supported versions, patched and reopened in a day or two. Teams still on unsupported versions faced backports or rebuilds, and for two small games that bill was larger than the game could justify. The work is not over: on 23 October, PHP published a further advisory on a less likely attack path through session upload progress, with a mitigation to apply until the next bugfix release. And according to the PHP 8.2.35 release notes, PHP 8.2 reaches end of life on 31 December 2026, so studios running live services on it have about two months to plan their next move.