The Critical PHP2Shell Exploit Has Forced Two 2011 Japanese Mobile Games Into Permanent Shutdown
While major Japanese publishers are breathing a sigh of relief as Pokémon HOME, Pokémon Sleep, and Pokémon Champions return online after emergency security maintenance on Thursday, October 22, 2026, smaller legacy titles have not been as fortunate. Two of Japan's longest-running mobile and browser games from 2011, World Quest and Boku no Makai wo Sukutte!, have been forced into immediate, permanent shutdowns after developers determined their aging server infrastructures could not be safely patched against the critical web exploit sweeping the globe.
How the PHP2Shell Vulnerability Crippled Legacy Japanese Game Servers
The crisis began on October 21 following the public disclosure of two critical unauthenticated remote code execution flaws in the PHP programming language, collectively tracked as PHP2Shell (CVE-2026-109618 and CVE-2026-109619). Carrying a severe 9.2 rating on the CVSS v4.0 scale, the vulnerabilities affect memory management and out-of-memory (OOM) error handling routines across PHP versions 5.4 through 8.5, allowing remote attackers to execute arbitrary code on unpatched web servers without authentication.
While modern live-service giants like The Pokémon Company and Cygames were able to initiate emergency server shutdowns across major Japanese mobile games for a few hours to deploy security patches on contemporary cloud environments, operators of early-2010s browser and mobile games hit a brick wall. Built during Japan's transition from flip phones (garakei) to early smartphones on platforms like GREE and Mobage, these titles run on deeply entrenched operating systems and end-of-life PHP configurations where upgrading the core language engine would break the entire game codebase.
World Quest: Revived During the Pandemic, Gone in an Instant
The first casualty of the security crisis was World Quest, a beloved social travel simulation game developed and operated by Manabu Igarashi Co., Ltd. Originally launched in April 2011 on the Japanese mobile social network GREE before expanding to Mobage, iOS, and Android, the game used open-source online maps to let players create custom avatars, decorate virtual rooms, and travel across real-world countries, landmarks, and UNESCO World Heritage sites from their phones.
What makes the sudden loss of World Quest especially poignant is how it survived its first death. After initially ending service on May 7, 2019, due to declining revenue, creator Manabu Igarashi brought the game back online in May 2020 during the height of COVID-19 border closures so housebound players could still experience the joy of virtual world travel. Because that 2020 revival relied on the exact legacy server architecture built in 2011 without new feature updates over the past six years, the studio had no way to shield the backend from the new PHP exploit, announcing an immediate permanent closure on October 21, 2026.
"A critical vulnerability was announced in the PHP language itself, which powers the World Quest servers. Because our game runs on an older system architecture, we cannot implement sufficient countermeasures against this flaw. Putting the protection of everyone's personal information first, we have made the decision to permanently end service today. We deeply apologize for this sudden announcement."
Manabu Igarashi Co., Ltd., official World Quest shutdown notice (October 21, 2026)
Boku no Makai wo Sukutte!: A 15-Year Demon Realm Forced to Close
Less than 24 hours later, on October 22, 2026, a second 15-year-old Japanese mobile staple met the same fate. Developed and published by JAGS Co., Ltd. and running continuously since 2011, Boku no Makai wo Sukutte! (affectionately known by fans as Bokumaka and translated in English as Save My Demonic World or Please Save My Pandemonium!) was a text-based idle fantasy simulation RPG. Players stepped into the role of a Demon King tasked with recruiting, training, and dispatching monster squads to reclaim a ravaged demon realm from invading human and divine armies.
Although active content updates had ended two years ago, JAGS had kept the servers running out of dedication to its long-time community, wishing to preserve the space for as long as possible even as player numbers dwindled. In a heartfelt farewell statement on the game's official website, the studio explained that after more than a decade of operation, both the physical server hardware and the underlying OS and PHP environment were too outdated to patch or migrate safely. Unwilling to leave user data exposed to potential remote code execution attacks, the team pulled the plug permanently,though they noted they do not want the Boku no Makai wo Sukutte! IP to end here forever, hoping to return to the Demon Realm in a different form someday.
My Take
Watching two 15-year-old games vanish overnight is a sobering reminder of how fragile early mobile and browser gaming history truly is. The story behind World Quest,brought back from the dead in May 2020 purely as a goodwill gesture so people stuck in lockdown could travel the world virtually,and JAGS quietly paying server bills for years just to keep Boku no Makai wo Sukutte! alive for a small circle of loyal players represent the very best of independent game development.
Unlike console cartridges or offline PC builds that preservationists can dump and emulate decades later, server-dependent mobile games from Japan's early social gaming era live at the mercy of foundational web security. When a critical vulnerability like PHP2Shell strikes, small studios maintaining decade-old codebases cannot afford a ground-up rewrite. Pulling the plug to protect player data is the only responsible choice they can make, yet every emergency shutdown like this permanently erases another irreplaceable chapter of gaming history.
SEO consultant for over 20 years and digital entrepreneur, Charles 'Grimtag' Ronchain is the founder of Pro-Gamer.gg, Retrocharting.com, and Gamescharting.com. A competitive gamer, streamer, and retro game collector, he has worked in the video game industry for over 15 years, notably as a consultant for leading game price comparison platforms. Passionate about real-time performance data and gaming technology, he analyzes competitive esports, gaming hardware benchmarks, and creator workflows on Pro-Gamer.gg with an authentic player perspective.
