PHP Security Fixes Take Several Online Games Offline
Several online games went offline or limited access this week while their operators applied emergency fixes for PHP, a programming language used to run website and game servers. Some services are back. Others are still being repaired.
On 21 October 2026, PHP developers released emergency updates for two critical flaws in the language's core. Google Cloud has listed them as CVE-2026-109618 and CVE-2026-109619, the standard codes used to track security weaknesses. Google Cloud describes one of them as a memory-handling problem that can interrupt PHP partway through a request. Reuters reported that the flaws could let attackers run commands without logging in, steal data or take websites offline.
The scale of the response has grown beyond games. Reuters reported that South Korea had activated an emergency response, and an EU agency warned that some websites might need to be taken offline while patches were prepared. Mashable reported that the two flaws leaked before their planned disclosure.
Final Fantasy XIV was among the first affected. Eurogamer reported that the game temporarily disabled new logins while security improvements were made to its patch servers. New logins have since been switched back on. The game's back-up feature for player save data remains offline.
Umamusume: Pretty Derby, a horse-racing game, was taken fully offline for emergency maintenance because its server-side systems use PHP. Server-side means the parts that run on the company's own computers rather than on a player's device. The developer said no exploitation of the flaw had occurred. Its Japanese and global servers are now back online, and players are to receive a compensation package of in-game currency.
Path of Titans, a dinosaur survival game from Alderon Games, and its website were taken down for up to three days as a precaution. Alderon Games said no data was compromised in the outage.
What this means for players is uneven so far. One game has restored logins, one is running again after maintenance with compensation promised, and one has been offline for up to three days while the studio checked its systems. Final Fantasy XIV's save back-ups are still unavailable, and the company has not given a return date.
The PHP project has not published a list of every affected service. Each operator is making its own call on how much to shut down, and how long each fix takes.
