Key information
On October 20, 2026, the PHP security team warned of two critical vulnerabilities, releasing patches on October 21. These flaws, rated with a CVSS score of 9.2, allowed for potential unauthenticated remote code execution, prompting immediate emergency maintenance across the domestic gaming sector.
Major publishers responded rapidly. Cygames performed emergency maintenance on titles like "Uma Musume Pretty Derby" and "Granblue Fantasy," though "Rage of Bahamut" faces an extended outage exceeding one week. Square Enix temporarily halted new logins for "Final Fantasy XIV" and suspended server backup functions, while Sega and Sony conducted maintenance on various product and support websites.
Operational impacts varied significantly. Bushiroad suspended services like "Bushinavi," leading to the cancellation of tournaments. DMM Games and FANZA Games underwent platform-wide maintenance, while Arc System Works announced an indefinite suspension of all web services starting October 23 to address security requirements.
The crisis proved fatal for older titles. Games such as "World Quest" and "Boku no Makai wo Sukutte!" announced service terminations, as developers deemed the security risks posed by their aging infrastructure and legacy PHP versions impossible to resolve. This highlights the critical necessity of maintaining updated system environments for long-term game viability.
