A vulnerability in the PHP programming language has caused a growing list of online titles, including Final Fantasy 14, Umamusume: Pretty Derby, and Pokemon Champions, to temporarily undergo emergency maintenance to implement a security patch. The issue came up after Final Fantasy 14 underwent two separate periods of server maintenance for unrelated issues.
Given that some modern video games require an Internet connection to play, this inevitably means that routine server maintenance will occur and render access temporarily unavailable. While downtime is usually brief, Final Fantasy 14 underwent 24 hours of server maintenance on October 12 to implement Patch 7.57, which introduced Same-region Player Matching to its Japanese servers. An additional round of maintenance to implement some hotfixes was later conducted on October 20.
Several Games and Services Affected PHP Security Maintenance
- Bandai Namco Entertainment
- Bungo and Alchemist
- CHUNITHM
- Final Fantasy 14
- Granblue Fantasy
- GOG Galaxy
- Heaven Burns Red
- Magia Exedra
- Nintendo Switch Online
- Pokemon Champions
- Pokemon Home
- Pokemon Sleep
- Princess Connect! Re:Dive
- Shadowverse: Worlds Beyond
- Steam
- Umamusume: Pretty Derby
Days after Square Enix sent out a warning to Final Fantasy 14 players concerning a round of account breaches, some players are completely unable to log into the game. Square Enix posted a notice that it had temporarily taken FF14‘s login servers online to implement a security patch, with no timetable for a return to normal service. However, users already logged into the game may keep playing. But, the ongoing problem affects more than just Square Enix. Several Pokemon games and apps, such as Pokemon Home, Pokemon Sleep, and Pokemon Champions, are also undergoing server maintenance to patch up a security flaw in the PHP programming language.
What’s That Weapon?
Identify the silhouettes before time runs out.
Shortly after starting its ongoing login server maintenance, Final Fantasy 14 confirmed on social media that the auto-demolition timer on player housing was temporarily paused across all its servers. Given that pausing the auto-demolition timer in FF14 is a measure usually taken in response to real-world natural disasters, the move from Square Enix is a potentially serious indicator of how much of a reach the PHP security flaw has.
The vulnerabilities were listed as CVE-2026-109618 and CVE-2026-109619, with each rated 9.2 out of 10 on CVSS. Simply put, each issue could allow a malicious hacker to steal sensitive information or compromise any server it gains access to. According to the BBC, the issues were discovered by researchers at the firms Calif and Wiz, which acknowledged that AI tools were used as part of the process. The PHP vulnerability has also caused government officials to weigh in on the matter. Japanese Prime Minister Sanae Takaichi stated on social media that companies should take prompt action via immediate patching or a temporary shutdown to protect users. Fixes have since been issued by the PHP team for versions 8.2 to 8.5.
In addition to online games being taken down to implement fixes, some Nintendo Switch Online services still remain inaccessible on both the Switch 2 and original Switch consoles as of this writing. Websites such as DeviantArt and Wikipedia also undertook periods of maintenance to implement security fixes, with the former coming back online at approximately 12:14 PM Eastern.
- Released
-
August 27, 2013
- ESRB
-
Teen / Blood, Language, Partial Nudity, Sexual Themes, Use of Alcohol and Tobacco, Violence, In-Game Purchases, Users Interact
- Engine
-
Originally the Crystal Tools engine, but currently it’s a custom engine using parts of the Luminous Engine.
