Security1 hOctober 21, 2026, 22:32

Pokemon and Umamusume go offline over critical PHP vulnerabilities

Pokemon Sleep, Pokemon HOME, Pokemon Champions and several Cygames titles including Umamusume, Granblue Fantasy and Shadowverse went into emergency maintenance on October 21 over two critical PHP flaws rated 9.2 that allow unauthenticated remote code execution. PHP released patches for versions 8.2 through 8.5; Nintendo has not confirmed its Switch Online maintenance is related.

Dexerto

Open source

Pokemon and Umamusume go offline over critical PHP vulnerabilities

The flaws CVE-2026-109618 and CVE-2026-109619 are rated 9.2 out of 10
PHP shipped fixes for versions 8.2, 8.3, 8.4 and 8.5
Cygames said a PHP vulnerability was found on Umamusume servers
Nintendo has not confirmed a link to Switch Online outages

#PHP#Pokemon#Cygames#Nintendo

Pokémon: Let's Go games get a native PC port

Security

GOG goes offline for maintenance amid PHP security emergency

Security

Finland Takes Government Websites Offline Over Critical Vulnerabilities

Gaming

Pokemon and Umamusume go offline over critical PHP vulnerabilities

Pokémon: Let's Go games get a native PC port

GOG goes offline for maintenance amid PHP security emergency

Finland Takes Government Websites Offline Over Critical Vulnerabilities

Steam store goes down as Valve seemingly joins PHP vulnerability wave