Umamusume, Granblue Fantasy and Niconico Hit Emergency Maintenance Over Two Critical PHP Flaws Rated 9.2

日本語版を読む →

Umamusume: Pretty Derby, Granblue Fantasy and Shadowverse: Worlds Beyond all went into emergency maintenance at 11:00 p.m. Japan time on October 21, 2026. The reason: two vulnerabilities rated 9.2 on the CVSS v4.0 scale were found in PHP, the programming language running their servers. The PHP development team gave advance notice on October 20 and shipped the patched builds PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 at 11:00 p.m. Japan time on October 21.

Cygames’ games were not the only things that went dark. Niconico went down at 7:20 p.m., Bandai Channel at 8:00 p.m., Heaven Burns Red at 10:30 p.m. and Pokemon Sleep at 11:00 p.m., while official sites and storefronts including pixiv, BOOTH, Bushiroad, Melonbooks, BOOK WALKER and BASE all halted on the same day. Tallies put the number of Japanese organizations responding at more than 54.

This article lays out what happened, which services are down and for how long, what players and shoppers should do today, and what anyone running a website needs to check. Everything here reflects the situation as of 11:00 p.m. on October 21, 2026, and maintenance end times will shift according to each service’s own announcements.

Let’s start with what actually happened.

Umamusume’s Los Angeles Shows Still Lack Visa Approval Three Days Out — Cygames to Announce Go or No-Go by 2 p.m. on October 20

October 20, 2026

What happened with the PHP vulnerabilities?

On October 20, the PHP development team announced that a security release fixing two vulnerabilities rated 9.2 on CVSS v4.0 would go live at 11:00 p.m. Japan time on October 21. At the time of that notice the stated scope was “all of PHP,” so services scheduled maintenance windows timed to the patch release without knowing what the flaws actually were. The fixed builds landed at 11:00 p.m. exactly as announced.

CVSS runs on a 10-point scale, and anything 9.0 or above falls into the “critical” band. That is where you find flaws that are easy to attack, easy to automate and expensive when they hit. Both of these let an outsider run code on the server, and since PHP is the foundation under WordPress and countless sites worldwide, the sheer breadth of exposure is what moved every company at once. Technical details were withheld at the notice stage to keep attack methods from spreading before the patch existed, which is standard procedure for a security release. As of October 21, no damage or data leaks had been confirmed at any Japanese service.

How long will Cygames’ Umamusume, Granblue Fantasy and Shadowverse WB be down?

Umamusume: Pretty Derby, Granblue Fantasy and Shadowverse: Worlds Beyond entered emergency maintenance at 11:00 p.m. on October 21. Granblue Fantasy has a provisional end time of 7:00 a.m. on October 22, while Umamusume and Shadowverse: Worlds Beyond have no announced end time.

Cygames’ notice states that two serious vulnerabilities were reported in the PHP running on its servers, that a patch was scheduled for release at 11:00 p.m. on October 21, and that the maintenance is being carried out to ensure system safety. Because the process means applying and then verifying the patch after it ships, an 11:00 p.m. start effectively means “work begins the moment the fix goes live.” For Umamusume, this maintenance landed the day after the Los Angeles show cancellation was announced, which makes two restless nights in a row for trainers. If you had dailies to clear or event deadlines looming, watch the post-maintenance announcements to see whether compensation is issued.

The full list of services down over the PHP vulnerabilities

Games aside, official sites for video, illustration, e-commerce and streaming tools across Japan went into maintenance one after another from the afternoon into the night of October 21. The list below covers what could be confirmed from press reports and company announcements, and end times are subject to change.

Line them up and a pattern emerges: games went down at 11:00 p.m., while video and e-commerce services pulled the plug early, starting in the late afternoon. Games have billing and matchmaking state to sync, so the call was to go down exactly when the patch dropped and apply it in one pass; e-commerce shut payment flows down first to cut off any risk at the root. OBS is a special case, since only part of the official website is unreachable rather than the software itself, so streaming is unaffected.

What should players and shoppers do today?

There are exactly two things users can do: wait for maintenance to end, and check each service’s official announcements for how compensation and campaign deadlines will be handled. This is a server-side vulnerability, so updating the app on your phone or PC accomplishes nothing, and there is no need to change your password at this point.

• For login bonuses and event deadlines, check the post-maintenance announcements to see whether compensation is being issued
• If you had an order or payment in flight at a store, check your order history once maintenance ends to confirm its status
• If you get an email or DM claiming to be about “PHP vulnerability response,” don’t click the link – verify on the official site instead
• No damage or data leaks had been confirmed as of October 21, so there is no reason to panic

On a day like this, the real danger isn’t the vulnerability itself but the fake email saying “please reset your password for emergency maintenance.” A night when everyone is hunting for official notices during a mass outage is a gift to phishers. Type the official URL yourself and check there. That’s all it takes.

What do site operators need to check?

If your own site or blog runs on PHP, update to one of the patched builds: PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35. On shared hosting, the provider manages the PHP version, so check their announcements and switch versions from the control panel. Japan’s IPA issued a “request for advance preparation” on October 21, urging operators to take stock of any environment running PHP.

1. Confirm whether your site runs on PHP (virtually every CMS, WordPress included, does)
2. On shared hosting, check the provider’s announcements and the PHP version setting in the control panel
3. If you manage your own server, make updating to the patched build your top priority
4. PHP 8.1 and earlier are past end of support and will not get patches. Migrating to 8.2 or later is the only option

Fixes exist only for the four branches from 8.2 through 8.5. Any site running on something older has no choice but to upgrade now. Security firms uniformly report that no workaround has been identified, so there’s no reason to put the update off. This site runs on WordPress too, which means tonight isn’t somebody else’s problem for me either.

Summary: the key points on the PHP vulnerabilities and the mass maintenance

Two vulnerabilities rated 9.2 on CVSS v4.0 (CVE-2026-109618 and CVE-2026-109619) were found in PHP, and the patched builds PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 were released at 11:00 p.m. Japan time on October 21, 2026. Umamusume: Pretty Derby, Granblue Fantasy and Shadowverse: Worlds Beyond went into emergency maintenance at 11:00 p.m. on the 21st, with Granblue Fantasy provisionally slated to return at 7:00 a.m. on the 22nd and the others with no end time announced. Niconico, Bandai Channel, Heaven Burns Red, Pokemon Sleep, pixiv, BOOTH, Bushiroad and BASE also went into maintenance the same day. No damage or data leaks had been confirmed as of October 21. Users should check official announcements for compensation and stay alert for fake emails. Site operators should treat updating to the patched build as their top priority.

Umamusume’s Los Angeles Shows Still Lack Visa Approval Three Days Out — Cygames to Announce Go or No-Go by 2 p.m. on October 20

October 20, 2026

The 20 Best Online Games: Top Free, PC, and Mobile Titles Worth Your Time

May 16, 2026