In response to reports of two critical vulnerabilities in the programming language “PHP,” it was announced that several game titles and related services—including *Uma Musume: Pretty Derby*, *Granblue Fantasy*, and *Shadowverse: Worlds Beyond*—will undergo emergency maintenance, primarily around 11:00 PM on Wednesday, October 21.
The PHP security team plans to release an update to fix the vulnerabilities at 11:00 PM on October 21 (Japan Standard Time). Each service is taking proactive measures to ensure security.
Two Critical Vulnerabilities Found in “PHP”—National Cyber Security Center and IPA Issue Warnings
This issue originated from an announcement by the security team at “The PHP Group,” which is responsible for the development and maintenance of PHP.
On October 20, the team revealed that two critical vulnerabilities had been identified in PHP. Both were rated 9.2 on the “CVSS v4.0” scale, which indicates the severity of vulnerabilities, and are classified as “Critical,” the most severe category.
A patch is scheduled to be released at 11:00 PM Japan Standard Time on Wednesday, October 21, and details regarding the vulnerabilities and affected versions are expected to be disclosed at that time.
In addition to an alert posted on the National Cyber Security Coordination Office’s official X account, the Information-technology Promotion Agency (IPA) is urging operators of systems that use PHP to prepare so they can apply the patch promptly once it is released.
The IPA has clarified that it has not yet confirmed any attacks exploiting this vulnerability and that this advisory is a precautionary measure taken in light of the potential for exploitation.
In light of this situation, a number of games and related services that use PHP have announced emergency maintenance to apply the patch.
Cygames Titles, Including “Uma Musume,” “Granblue Fantasy,” and “Shadowverse WB,” to Undergo Emergency Maintenance
Several titles operated by Cygames are scheduled to undergo emergency maintenance, primarily around 11:00 PM on October 21.
The horse-raising simulation “Uma Musume: Pretty Derby” announced via its official X account that maintenance to ensure system security will begin around 11:00 PM on Wednesday, October 21. Players will be unable to launch or play the game during this period.
The RPG “Granblue Fantasy” has also announced via its official X account that emergency maintenance will take place from 11:00 PM on Wednesday, October 21, until 7:00 AM on Thursday, October 22. The end time is tentative and may be subject to change depending on circumstances.
Additionally, “Shadowverse: Worlds Beyond” has announced via its official X account that it will undergo emergency maintenance starting at 11:00 PM on Wednesday, October 21, with an undetermined end time.
The game’s operations team explained that around 1:00 a.m. on October 21, The PHP Group announced a vulnerability in the PHP software used by the servers. They stated that no damage or leakage of user data resulting from this vulnerability has been confirmed.
Please check the official X account and official websites for updates on the completion times and progress of maintenance for each title.
"Dolphin Wave" and "Chunism" Also Affected—OBS Official Website Partially Unavailable
Emergency response measures are not limited to Cygames titles but have expanded to other game titles and related services for streamers.
For “Dolphin Wave,” developed by Marvelous and HONEY∞PARADE GAMES, an announcement was made on the official X account stating that emergency maintenance will begin around 11:00 PM on Wednesday, October 21. The game will be unavailable during maintenance.
Sega’s arcade music game “Chunithm” also announced via its official X account that it would conduct emergency maintenance to address a PHP vulnerability affecting the linked service “CHUNITHM-NET” and the official website.
However, gameplay on arcade cabinets using “Aime” will remain available during the maintenance period. The impact is primarily limited to web-related services; the game itself will not be completely suspended.
"Heaven Burns Red" has also announced that it will undergo maintenance starting at 10:30 PM on Wednesday, October 21, to implement security measures.
Furthermore, the development team behind the game streaming and recording software “OBS Studio” has also provided guidance on its official X account.
While awaiting the release of detailed information regarding the PHP vulnerability, parts of the official OBS website will be unavailable. However, it has been explained that this will not affect streaming via OBS Studio itself or the streaming functionality using linked accounts.
As such, the responses to this vulnerability vary by service, ranging from maintenance of the game itself to the temporary suspension of official websites and linked services.
Measures will be implemented across various services primarily around 11:00 PM tonight—be sure to check official announcements
PHP is a programming language widely used in websites and online services. As part of the response to this vulnerability, further maintenance or temporary access restrictions may be announced for the game and related services in the future.
However, not all services using PHP will be suspended; whether they are affected and the necessary measures will vary depending on the user’s environment. Furthermore, the implementation of emergency maintenance does not necessarily mean that unauthorized access or data breaches have occurred.
If you plan to play any titles after 11:00 PM on Wednesday, October 21, be sure to complete any necessary in-game actions in advance and check the latest maintenance information on each title’s official X account or website.
