The impact of a critical vulnerability discovered in the programming language “PHP” is now spreading to the operation of online games.
Starting on the evening of October 21, numerous games—including *Uma Musume: Pretty Derby* and *Granblue Fantasy*—underwent emergency maintenance. Meanwhile, *World Quest* and *Save My Demon World!*, two titles that had been in service for many years, announced the termination of their services, citing the difficulty of addressing the vulnerability.
“PHP2Shell,” a vulnerability rated 9.2 on the severity scale, triggers a wave of emergency responses in Japan
The issue at hand is a critical vulnerability in “PHP,” a programming language widely used in the development of websites and online services.
On October 21 (local time), the PHP development team released patches for two vulnerabilities: “CVE-2026-109618” and “CVE-2026-109619.”
Both vulnerabilities are rated 9.2 on the “CVSS v4.0” severity scale and are also known as “PHP2Shell (php2shell).” There is a risk that attackers could execute arbitrary code from outside the system without authentication, which could lead to server takeovers or the leakage of confidential information.
The official PHP website has released the following patched versions: “8.2.35,” “8.3.36,” “8.4.27,” and “8.5.12.” While older versions of PHP that are no longer supported are also affected, the PHP development team does not provide patches for those versions; therefore, mitigation requires migrating to a newer environment.
In Japan, the Information-technology Promotion Agency (IPA) and the National Cyber Security Office have issued warnings. On October 21, Prime Minister Sanae Takaichi also made an unusual appeal via her X account, explaining that temporarily suspending websites and other services is an effective countermeasure if promptly applying the patches is difficult.
In response to this situation, a series of emergency maintenance operations took place not only on gaming sites but also on online shopping sites, various web services, and government agency websites.
It should be noted that these maintenance operations do not necessarily mean the sites were attacked by exploiters of the vulnerability; they also include measures taken to prevent potential damage.
"World Quest" Ends Service Immediately on October 21
One of the titles significantly affected by this was the authentic travel game “World Quest.”
The game launched on GREE in 2011 and was also available on platforms such as Mobage. Set in over 100 real-world countries and more than 1,000 cities, it allowed players to travel around the globe using various modes of transportation.
Although the service was initially discontinued in May 2019, it was relaunched in May 2020 to allow people—for whom overseas travel had become difficult due to the COVID-19 pandemic—to enjoy traveling within the game.
However, on October 21, the operators announced via their official X account that the service would end that very day.
The reason cited was the discovery of a critical vulnerability in the PHP used by the game’s servers. The operators explained that because the game ran on an outdated system, they were unable to implement sufficient countermeasures; therefore, they decided to shut down the service to prioritize protecting user information.
They also apologized for the sudden announcement, and thus, a game that had been running for many years came to an end without even a notice period.
“Save My Demon World!” Also Draws a Close After Over 10 Years
Furthermore, on October 22, JAGS announced the end of service for its smartphone game “Save My Demon Realm!”
Released in 2011, this game is an idle, cloud-based fantasy simulation RPG. It has long been beloved as a game where players take on the role of a Demon King, leading monsters on expeditions to various regions to reclaim the Demon Realm from humans.
However, on October 22, the official X account announced that service would be discontinued because it had become difficult to address a serious PHP vulnerability. The developers apologized for the sudden news and expressed their gratitude to users who had played the game for over 10 years.
This title has also been in operation for a long time, since 2011, and this incident demonstrates that when faced with serious issues with underlying technology, updating or migrating from an outdated operating environment can pose significant challenges.
While the official X announcement cited the difficulty in addressing the vulnerability as the reason for the shutdown, specific details regarding the server configuration or the nature of the technical issues that prevented the update have not been disclosed.
“Uma Musume” and “Granblue Fantasy” Resume Service After Emergency Maintenance
Meanwhile, major game titles have been seen temporarily suspending service to implement security measures before resuming operations.
Titles operated by Cygames—including “Uma Musume: Pretty Derby,” “Granblue Fantasy,” “Shadowverse: Worlds Beyond,” and “Princess Connect! Re”—underwent emergency maintenance one after another starting on the evening of October 21.
Subsequently, “Shadowverse: Worlds Beyond” announced the end of maintenance in the early hours of October 22. “Princess Connect! Re” concluded maintenance at 2:10 a.m. that same day, while “Uma Musume Pretty Derby” finished at 2:30 a.m.
*Granblue Fantasy* also completed maintenance at 7:00 a.m., but at that time, the DMM and GREE versions were not yet restored, resulting in differences in service restoration status depending on the platform.
The developers of these titles have stated that, as of the time the emergency maintenance was announced, no incidents of damage caused by exploitation of this vulnerability or leaks of user data had been confirmed.
The Vulnerability That Triggered the Service Outage: Challenges Facing Long-Running Titles
This series of events has highlighted that, in the long-term operation of online games, not only the game content itself but also the maintenance and updating of the servers and software that support it are indispensable.
When a critical vulnerability is discovered in the underlying programming language itself, as in this case, simply fixing certain game features may not be sufficient to ensure adequate security.
In particular, titles that have been in operation for over 10 years may still rely on systems designed for the environment of that time. Migrating to a new version may require a significant amount of work, such as modifying existing programs and conducting functional testing.
Of course, the feasibility of such a response isn’t determined solely by the scale of the game. However, the two titles for which the decision to end service was made in this instance were both long-running franchises.
While it is disappointing for players to suddenly lose access to these games, we cannot ignore the operators’ decision to prioritize the protection of user information and their judgment that continuing the service safely was no longer feasible.
This incident has once again highlighted the difficulty of maintaining long-running online games and keeping them playable well into the future.
