Look, let's be honest, when two major security vulnerabilities are unmasked in PHP—a staple web server-side language and general-purpose programming language—the shockwaves are bound to hit government websites and gaming services alike. While Finland preemptively locked down its government web services, the gaming industry scrambled through emergency inspections, with at least one title opting to pull the plug entirely rather than deal with the security nightmare.

First off, Cygames announced that it would run an inspection starting around 11:00 PM on the 21st to tackle the PHP vulnerabilities in Uma Musume Pretty Derby, which is currently live in Japan. Sega also jumped into the fray at 10:55 PM on the same day, putting its product information site under emergency maintenance to patch the critical PHP security flaws.

Choice of Games, an American text-based interactive novel and game developer, also took to its official forum on the 21st to announce that serious vulnerabilities had cropped up in the PHP powering the site, forcing a temporary shutdown. The management team noted that the site would stay down until a security patch dropped and could be applied. Meanwhile, Final Fantasy 14 suspended its patch servers to reinforce security against the PHP exploits, leaving players unable to log in across all servers.

Things got even worse for the web game World Quest, which decided to call it a day and shut down for good. The team behind World Quest announced on the 21st that they had received word of severe vulnerabilities lurking within the server's PHP itself, prompting an immediate end to service on that very day. Management explained that the system was simply too ancient to mount a proper defence, making the closure a necessary call to protect user data.

The vulnerabilities in question were unearthed in PHP, which handles the server-side logic of websites. Tracked under the identifiers CVE-2026-109618 and CVE-2026-109619, the flaws could allow an attacker to execute arbitrary code on the server without authentication under certain conditions. In response, the PHP development team rolled out patched versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35 on the 21st, strongly advising an immediate update.

So far, no game hacking incidents exploiting these vulnerabilities have been reported, and developers are actively pushing out service suspensions and updates to keep security risks at bay.