Pokémon HOME, Pokémon Champions and Umamusume Taken Offline as Critical PHP2Shell Flaw Forces Emergency Server Shutdowns
Just hours after widespread disruptions hit Valve's digital storefront, a massive wave of emergency maintenance is sweeping across Japan's biggest live-service games on October 21, 2026. From Pokémon HOME and Pokémon Champions to Umamusume: Pretty Derby and Granblue Fantasy, major publishers are preemptively pulling their servers offline to patch the critical "PHP2Shell" vulnerabilities (CVE-2026-109618 and CVE-2026-109619).
Pokémon HOME, Sleep, Champions and Cygames Titles Placed Under Emergency Maintenance
Players attempting to transfer creatures, sync sleep tracking data, or log into their daily training sessions today were abruptly met with unscheduled maintenance screens and indefinite return windows. On The Pokémon Company's side, several core connected applications were swiftly taken offline as a precautionary measure: Pokémon HOME, Pokémon Sleep, and the competitive battle platform Pokémon Champions have all suspended online connectivity while engineers secure their backend APIs.
Meanwhile, Japanese publisher Cygames officially confirmed that it pulled its flagship live-service titles offline to address the critical PHP server vulnerability. The titles currently undergoing emergency security maintenance include:
- Umamusume: Pretty Derby (Mobile and PC);
- Granblue Fantasy;
- Shadowverse: Worlds Beyond;
- Princess Connect! Re:Dive.
Both publishers emphasized that the shutdowns are strictly preventative infrastructure measures. Player accounts, cloud monster boxes, progression histories, and in-game currencies remain safe and uncompromised while server clusters are updated.
Inside PHP2Shell (CVE-2026-109618 and CVE-2026-109619): Why Studios Are Pulling the Plug
The catalyst behind this coordinated gaming blackout is the premature public leak of two critical, pre-authentication Remote Code Execution (RCE) vulnerabilities in the core PHP runtime engine (affecting PHP 5.4 all the way through 8.5.11). Collectively dubbed PHP2Shell and carrying a severe CVSS score of 9.2 out of 10, the exploit chain targets two deep memory management flaws:
- CVE-2026-109618 (Out-of-Memory Cleanup Corruption): when an intensive request (such as parsing
multipart/form-datapayloads) exceeds the configuredmemory_limit, PHP aborts execution via C'slongjmp()function while internal request structures are only partially initialized. The subsequent shutdown routine mistakes this half-initialized state for valid memory and attempts to free unallocated pointers, enabling remote code execution. - CVE-2026-109619 (Stale Global State / Use-After-Free): within persistent worker processes such as PHP-FPM, fatal errors can leave request-owned internal states dangling after their backing memory regions have been freed. A subsequent request handled by the same persistent worker can then manipulate those freed pointers before initialization routines overwrite them.
Because working exploit details leaked into the wild just as the PHP development team rolled out emergency patches on October 21 (versions PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35), international cybersecurity agencies including CERT-EU urged organizations to immediately take vulnerable internet-facing services offline until patched. Earlier today, the exact same security rush triggered a global Steam Store outage and Error E502 L2 as web infrastructure teams scrambled to lock down their servers.
My Tech Bench
Looking closely at how Japanese mobile giants and companion apps architect their backends, it makes complete sense why The Pokémon Company and Cygames reacted so decisively. From the browser-based foundations of Granblue Fantasy to the modern REST APIs powering Pokémon HOME and Pokémon Champions, a massive portion of Japan's game authentication, session routing, and telemetry pipelines relies on high-concurrency PHP-FPM worker pools.
What makes CVE-2026-109619 particularly dangerous in a live-service gaming environment is that it preys directly on persistent worker reuse across sequential HTTP requests. When an unauthenticated RCE exploit is actively circulating in the wild, relying solely on Web Application Firewall (WAF) rules or payload size limits is a gamble no studio should take with millions of player accounts on the line. Taking the servers dark for a few hours to deploy PHP 8.3.36 or 8.4.27 images and flush every worker pool is the only responsible engineering call.
PC hardware enthusiast and competitive gamer, Arthur 'Heimdall' splits his time between France and the UK working in enterprise B2B software solutions. A business school graduate passionate about component benchmarking, he has been building, modding, and tuning PCs since childhood, optimizing every thermal degree and millisecond of display latency. An avid gamer across Assassin's Creed and sandbox titles, he forged his alliance with Grimtag and Chaya during late-night World of Warcraft raids before joining Pro-Gamer.
