Pokemon, Umamusume and other major games taken offline over critical PHP

Pokemon Sleep, Pokemon HOME, Pokemon Champions and several major Japanese games have been taken offline for emergency maintenance as developers respond to two critical PHP vulnerabilities.

The outages began on October 21, shortly before the PHP development team released security updates for the flaws. Several services have not provided an estimated return time, leaving players unable to access their games or online accounts indefinitely.

Pokemon, Umamusume and major games affected

Pokemon Sleep announced emergency maintenance on October 21, with no initial end time provided. Serebii also reported maintenance affecting Pokemon HOME, Pokemon Champions and Nintendo’s wider Switch 1 and Switch 2 online services.

https://twitter.com/SerebiiNet/status/2112876976281412063

Players also shared screenshots and reports of the outages across social media.

https://twitter.com/SleepykyuSH/status/2112873591427797168

Pokemon HOME is used to store and transfer Pokemon between compatible games, while Pokemon Champions relies on the service for some of its transfer features. Dexerto previously covered how the two services connect in our guide to Pokemon HOME connectivity in Pokemon Champions.

Nintendo has not confirmed that the reported HOME, Champions or Switch online maintenance is directly connected to the PHP vulnerabilities. However, the timing of the outages has led to speculation that the services are being patched or isolated as a precaution.

Cygames also announced emergency maintenance for several of its games, including Umamusume: Pretty Derby, Granblue Fantasy, Shadowverse: Worlds Beyond and Princess Connect! Re:Dive.

The official Umamusume notice specifically said that a PHP vulnerability had been identified in the game’s servers and that maintenance was required to address it.

https://twitter.com/thelandfish7/status/2112879150239256927

Granblue Fantasy and Princess Connect! Re:Dive issued similar maintenance notices. Shadowverse: Worlds Beyond was also reported to be affected, with Japanese technology outlets linking its maintenance to the same PHP security issue.

CHUNITHM’s international account separately warned players that a vulnerability had been reported in PHP and that emergency maintenance would be carried out.

At the time of writing, the affected services include:

Pokemon Sleep

Pokemon HOME

Pokemon Champions

Nintendo Switch 1 and Switch 2 online services

Umamusume: Pretty Derby

Granblue Fantasy

Shadowverse: Worlds Beyond

Princess Connect! Re:Dive

CHUNITHM

The outages do not mean that every listed service has been hacked. In several cases, developers appear to be taking their servers offline to apply patches or prevent potential attacks.

What the PHP vulnerability means in simple terms

PHP is a programming language used to run the behind-the-scenes parts of websites and online services. Players do not run PHP directly on their consoles or phones. Instead, it operates on servers that handle logins, account information, purchases and other online features.

The two newly patched vulnerabilities were rated 9.2 out of 10 by the PHP team and can allow unauthenticated remote code execution. In simple terms, an attacker may be able to send a specially designed request to a vulnerable server and trick it into running commands chosen by the attacker.

That could let someone alter a website, steal information, install malicious software or use the compromised server to attack other systems.

https://twitter.com/takaichi_sanae/status/2112890642590564386

PHP released fixes for versions 8.2, 8.3, 8.4 and 8.5 and urged administrators to update immediately. The PHP team said there were no complete workarounds, meaning affected operators needed to patch their installations or temporarily take vulnerable services offline.

The vulnerabilities are listed as CVE-2026-109618 and CVE-2026-109619. CERT-EU has advised organizations to isolate internet-facing applications if they cannot apply the updates immediately.

The full impact on gaming services remains unclear, and Nintendo has not confirmed whether its reported maintenance is connected to the PHP issue. However, simultaneous outages across Pokemon, Cygames and arcade services show how quickly a server-side security problem can affect players around the world.