Enjoying this article? Add us as a preferred source on Google.
A server vulnerability wipes out an entire game. That actually happened to two titles between October 21 and 22, 2026.
The patched builds the PHP development team released on October 21 local time address two issues, CVE-2026-109618 and CVE-2026-109619. The CVSS v4.0 score is 9.2. Nicknamed PHP2Shell, it reportedly allows arbitrary code execution from outside with no authentication — the worst class of hole a web server can have.
Two browser games that couldn’t plug that hole announced shutdowns back to back: World Quest on October 21, and Boku no Makai o Sukutte! on October 22. Both were long-running titles that had been live since 2011. Other games, meanwhile, rode it out with emergency maintenance. Here’s what happened and what separated the survivors from the casualties.
What kind of vulnerability is PHP2Shell?
It’s a critical vulnerability in PHP itself that may allow arbitrary code execution from outside with no authentication. Two CVEs apply, CVE-2026-109618 and CVE-2026-109619, and the severity is rated 9.2 on CVSS v4.0.
Arbitrary code execution means a third party who doesn’t own the server can run whatever program they like on it. Taking over the machine and exfiltrating the contents of a database both become possible in principle. Because PHP is used so widely as the foundation of websites, the blast radius isn’t limited to any particular game or service.
The patched versions are as follows.
| Branch | Patched version |
|---|---|
| PHP 8.2 | 8.2.35 |
| PHP 8.3 | 8.3.36 |
| PHP 8.4 | 8.4.27 |
| PHP 8.5 | 8.5.12 |
The problem is that older, end-of-life PHP versions are affected too, and no fixes are being issued for them. Any service running on an old environment stays wide open unless it migrates to a newer one. That’s exactly what links this flaw directly to the two shutdowns.
In Japan, the Information-technology Promotion Agency (IPA) and the National Cyber Office both issued advisories. On October 21, Prime Minister Sanae Takaichi went a step further with an unusual appeal on her own X account, explaining that temporarily taking a website offline is also a valid countermeasure when applying the patch isn’t feasible. A sitting prime minister weighing in directly on a specific vulnerability is, as far as I can remember, almost unheard of.
Which two games decided to shut down?
The two that closed are World Quest and Boku no Makai o Sukutte!, both browser games that had been running since 2011.
World Quest: shut down at the end of October 21
Launched on GREE in 2011 and later rolled out on multiple platforms including Mobage, it was a serious travel game. Set across more than 100 real-world countries and over 1,000 cities, it had you touring the globe by all kinds of transportation. It actually shut down once in May 2019, then came back in May 2020 in response to a world where nobody could travel during the pandemic.
The announcement came via the official X account on October 21 — and the shutdown took effect at the end of that same day. The stated reason is the critical PHP vulnerability on its servers: because the game ran on old plumbing, adequate countermeasures weren’t possible, and the team decided to close rather than put user information at risk. There was no advance notice period, and the operators apologized for the abruptness.
Boku no Makai o Sukutte!: shutdown announced October 22
An idle, cloud-based fantasy simulation RPG from JAGS that debuted in 2011. You play as a demon lord leading monsters on expeditions to take back the demon world that humans stole.
This one also announced its closure on its official X account, on October 22. The reason given is the difficulty of responding to the severe PHP vulnerability, along with thanks to users who had played for more than a decade. No specifics about the server setup or the technical problems were disclosed.
What the two share is that launch year, 2011. For a service that’s been running for close to 15 years, the cost of swapping out the PHP underneath it stops being realistic. The call itself — protecting users’ information rather than keeping the game playable — strikes me as sound.
Which titles came back after emergency maintenance?
Four titles operated by Cygames went into emergency maintenance one after another starting the night of October 21, and all of them were back up during October 22.
| Title | Maintenance ended |
|---|---|
| Shadowverse: Worlds Beyond | Early hours of October 22 |
| Princess Connect! Re: Dive | October 22, 2:10 a.m. |
| Umamusume: Pretty Derby | October 22, 2:30 a.m. |
| Granblue Fantasy | October 22, 7:00 a.m. |
For Granblue Fantasy, the DMM and GREE versions were listed as excluded when the end of maintenance was announced. For all four titles, the notices stated that no damage from exploitation of the vulnerability and no leak of user data had been confirmed at the time of posting.
This part is worth emphasizing. Emergency maintenance doesn’t necessarily mean a service was attacked. It also covers preventive measures. Online stores, all sorts of web services, and even government agency sites went into emergency maintenance in quick succession, but that doesn’t mean every one of them was breached. If anything, a service that could take itself down and patch within a few hours proved it had the structure in place to respond.
Enjoying this article? Add us as a preferred source on Google.
What should you take away from all this?
There are moments when a browser game’s lifespan is decided not by what’s in the game but by whether its foundation can still be maintained. That came into sharp focus here.
To recap: the PHP vulnerability covers two CVEs, CVE-2026-109618 and CVE-2026-109619, rated 9.2 on CVSS v4.0 and nicknamed PHP2Shell. The patched versions are 8.2.35, 8.3.36, 8.4.27, and 8.5.12. End-of-life PHP versions get no fix. As a result, World Quest announced it would close at the end of October 21, and Boku no Makai o Sukutte! announced its shutdown on October 22. Cygames’ four titles were all restored during October 22 after emergency maintenance.
Getting 15 years out of a browser game that started in 2011 is rare enough on its own. Even so, ending with a “we close today” notice leaves a bitter taste. If you were playing either of these, it’s worth saving a few screenshots while you still can.
The dividing line here wasn’t a game’s popularity or its revenue. It was one thing: whether the architecture allowed PHP to be upgraded. Titles that could go dark and patch within hours on one side, titles running on old foundations that will never get a fix on the other. That gap is what turned into “service continues” versus “shut down the same day.”
The longer a browser game has been playable, the older its foundation. A shutdown notice landing out of nowhere is a possibility for any of them.
Read Next
Nokko Oda
Leave a Reply