Two high-severity PHP security vulnerabilities have affected multiple online games and related services. Operators have temporarily shut down servers or restricted player logins to deploy security patches. Titles such as Final Fantasy XIV and Pokémon Champions have been impacted.
Square Enix has temporarily shut down the login servers for Final Fantasy XIV and has not yet announced a timeline for restoration. Players who are already logged in can continue playing, and the automatic demolition timers for player housing on all servers have been paused.
Other affected games include Uma Musume Pretty Derby, Pokémon HOME, Pokémon Sleep, Granblue Fantasy, Princess Connect! Re:Dive, and Shadowverse: Beyond the World. Several Pokémon games and applications have entered server maintenance, and services such as Nintendo Switch Online, Steam, and GOG Galaxy have also been impacted. At the time of the announcement, some Nintendo Switch Online services on both Switch 2 and the original Switch remained unavailable.
The two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, both carry a CVSS score of 9.2. They could lead to the theft of sensitive information or allow attackers to compromise accessible servers. Discovered by researchers from Calif and Wiz, the PHP team has released fixes for versions 8.2 through 8.5. Beyond the gaming industry, platforms like DeviantArt and Wikipedia also underwent maintenance to deploy security fixes.