As critical security vulnerabilities were recently discovered in PHP, a programming language widely used for building websites and online game servers, cases have emerged in Japan where games are going beyond emergency maintenance to permanently shutting down their services.
On October 21, developer JAGS announced the end of service for "Please Save My Pandemonium!", an idle simulation RPG that had been in operation since 2011. While service shutdowns typically occur due to financial or staffing issues, this termination was distinct in that it was directly caused by the recent critical PHP security vulnerabilities. Alongside it, "World Quest"—a travel simulation game that launched in 2011, shut down in 2019, and was later relaunched due to user demand—also announced its service termination.
The PHP language in question is one of the world's most widely used general-purpose programming languages for website creation and server-side (backend) development of online services. In mobile and web-based gaming in particular, it is broadly utilized as a core foundation when building API servers that process real-time client requests—such as logins, item acquisitions, payments, and stage entries—and handle database communications.
The issue originated on October 21 (local time) with the disclosure of critical security vulnerabilities in the PHP core engine—"CVE-2026-109618" and "CVE-2026-109619," dubbed "PHP2Shell." Scoring a severe 9.2 on the Common Vulnerability Scoring System (CVSS v4.0), these vulnerabilities carry a critical flaw allowing attackers to exploit server memory handling defects and execute remote code (RCE) without authentication, simply by sending crafted external requests. At worst, attackers could seize full control of servers or leak sensitive user data stored in databases.
In Japan, security authorities including the Information-technology Promotion Agency (IPA) and the National Cybersecurity Office immediately issued advisory warnings. The Japanese gaming industry, which relies heavily on PHP for backend infrastructure, also entered emergency response mode across the board. While the situation has somewhat stabilized after security patches were released for PHP versions 8.5.12, 8.4.27, 8.3.36, 8.2.35, and above, problems arose for games running on legacy versions that no longer receive technical support. Forcing a PHP version upgrade risks backward compatibility issues that could cause existing game code to malfunction.
Expressing their regret, the operations teams of the two games explained that after maintaining their games through continuous updates since launching on infrastructure over a decade old, they were unable to safely address the current vulnerability. Because continuing operations would pose a security threat to users, they were left with no choice but to terminate service.
In addition, several games also serviced in South Korea—including "Princess Connect! Re:Dive," "Uma Musume: Pretty Derby," "Shadowverse: Worlds Beyond," "Another Eden," and "Heaven Burns Red"—entered emergency maintenance to address the PHP vulnerability. Most of these titles maintained modern server environments, allowing them to complete defensive measures and sequentially resume services starting early on October 22.
Meanwhile, response efforts to this PHP issue have been underway in South Korea as well as Japan. South Korea's Financial Security Institute (FSI) issued a security advisory to financial institutions, while the Korea Internet & Security Agency (KISA) urged various industries to implement security updates. To proactively mitigate the potential for large-scale hacking attacks, the Ministry of Science and ICT (MSIT) raised the private-sector cyber crisis alert level from 'Attention' to 'Caution.'
