A Critical PHP Flaw Knocked Pokemon Home and Sleep Offline and Killed Two Old Japanese Mobile Games for Good

By CriticalPixel · 2026-10-22

A pair of critical bugs in PHP, the scripting language that Kotaku says is estimated to power roughly 70 percent of the internet, turned this week into a rolling blackout for mobile games. The Pokémon Company pulled Pokémon Home, Pokémon Champions and Pokémon Sleep into emergency maintenance, and in Japan at least two old mobile games have been shut down permanently because their servers cannot be patched. The PHP project published its security advisory on October 21 and told every user to update immediately. This is the kind of story that normally lives in sysadmin channels, and this time it reached the app where you store your Pokémon. If a game of yours went dark with a vague maintenance banner, this is the likely reason.

Official Pokemon Sleep emergency maintenance notice posted on October 21, 2026

What the PHP project actually announced

The PHP project's own news page lists a security advisory dated October 21, 2026, titled critical remote code execution vulnerabilities, update now. It says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix two critical flaws that can allow unauthenticated remote code execution, tracked as CVE-2026-109618 and CVE-2026-109619. An earlier post on October 20 gave advance notice that the security release would land on Wednesday, October 21 at 14:00 UTC, and that both bugs were rated CVSS v4.0 9.2. That heads-up matters, because once fixes ship, anyone can study them and work out what was broken. Operators had a narrow window to patch or pull servers offline before the technical details spread, and a lot of them chose to pull the plug.

Kotaku reports the flaws are said to reach back as far as PHP 5 from 2004, and that they let an attacker run commands on a web server and then make it do whatever they like, including loading malware. Various governments took down their own websites rather than sit exposed, and DeviantArt and Ars Technica went temporarily inaccessible while they prepared updates. The UK's National Cyber Security Centre advised that anyone who cannot apply the temporary mitigations, or whose fix would take too long, should consider taking the system offline until it is fully mitigated. Patching is not a single step either, because third-party software vendors that build on PHP have to ship their own updates before downstream sites are safe. Millions of sites sit in that gap, and games are just the part of the pile that players notice.

Pokémon takes three apps offline

Kotaku tried Pokémon Home on a phone and got a Japanese error saying the service was under maintenance, while Pokémon Champions started to load and then showed a message about ongoing emergency maintenance. Neither gave any hint of when it would return. The official Pokémon Sleep account posted its own emergency maintenance notice, with downtime starting October 21 at 2:00 PM UTC, an estimated completion time listed as to be determined, and the reason given as system security measures. During the downtime players could not start tracking sleep, and anyone who began tracking before the shutdown might not be able to complete their sleep research properly. To be clear about what is confirmed, that notice does not name PHP, and the link between the three Pokémon apps and the vulnerability comes from Kotaku's reporting on the timing and the official warnings.

There is something almost funny about a sleep tracker that cannot track sleep because a web scripting language had a very bad day, but the underlying point is serious. These apps lean on web back ends for accounts, storage and transfers, and when the back end is the thing under threat, the only safe move is to switch it off. Pokémon Home in particular holds years of collections that players have moved between games, so a long outage with no end time makes people nervous. Pokémon Champions, a competitive title, depends on servers staying up for ranked play. The Pokémon Company made the cautious call, and for a service holding that much player progress, I would rather see a day of downtime than a hole in the server.

Two old Japanese mobile games are not coming back

The harsher story is in Japan, where some services run on old, deprecated software that cannot be updated at all. World Quest launched in 2011 on the Japanese mobile service GREE as a social travel game, where players built avatars and virtually visited countries and landmarks using open-source online maps. It shut down in 2019, then came back in 2020 exactly as it was, to let people travel while borders were closed during COVID-19. Because it ran on the same code since 2011, it had received no updates in six years, yet kept an active player base. The official World Quest account announced the closure, saying a serious vulnerability was found in the PHP used on its server, that the old mechanism could not be given sufficient protection, and that the service would end that day to safeguard everyone's information.

Official World Quest service closure notice citing a serious PHP vulnerability

A text-based community RPG called Save My Demonic World was also forced to close this week. Its developer ended updates two years ago, so its aging systems could not take the fixes either. Kotaku's Alicia Haddick frames these two as the high-profile examples of a bigger problem, since many old websites and services that are no longer maintained now risk going offline for good, and bits of internet history that were already breaking down could be locked away. Reaction I could verify is limited: Kotaku points to a pair of Japanese posts, one reminiscing about playing World Quest and one thanking its development team, and I would not call that a consensus. What is clear is that the shutdowns came from developers who decided that a permanent closure was safer than running an unpatchable server.

What this means for the rest of your library

Nothing in the sources I read describes stolen player data, and the shutdowns and maintenance windows all read as precaution rather than aftermath. Still, this episode shows how thin the line is between a game being online and a game being gone. World Quest was revived in 2020 with a promise, in spirit, that it would stay available, and it took one bad vulnerability disclosure to end it. Every always-online game depends on a server stack someone must keep patching, and the moment a publisher stops paying for that, the game becomes one critical bug away from deletion. Single-player titles that quietly require an online check, or a web account, sit on the same cliff edge.

The CriticalPixel take

My honest read is that the Pokémon outages will be a footnote by the weekend, and the World Quest closure is the part that should stick. Publishers love to talk about live service as a long-term relationship, then leave legacy servers running on decade-old code with nobody assigned to maintain them. When that neglect meets a CVSS 9.2 bug, players lose a game they had every reason to think was safe, and it does not even make the front page. If you care about a mobile game that has not been updated in years, screenshot your progress, save what you can, and do not assume it will be there next month. Keep an eye on official channels for the Pokémon apps too, because Home, Champions and Sleep should return once patching is finished, though none of the notices I read gave a firm date.

This story is still moving, and operators will keep posting updates as they finish their patches. We will cover the follow-up if a bigger name goes down or if anyone confirms a breach tied to these bugs.