Several online games went offline this week after the disclosure of a serious vulnerability in PHP, the programming language behind a large share of the web services that run them. Eurogamer reported that Final Fantasy 14 and the horse-racing gacha game Umamusume: Pretty Derby were among the titles affected.
Because the flaw could lead to substantial security breaches on sites and applications built with PHP, operators were advised to take services offline until a fix could be distributed and applied, according to Eurogamer. Games built on that infrastructure were caught up in the shutdowns.
Square Enix posted to the Final Fantasy 14 Lodestone that security "enhancements" were being made to the MMO's patch servers, and temporarily disabled new logins until the work was finished. Logins have since been turned back on, Eurogamer reported, though the server-side backup feature for player save data remains offline. Dexerto identified the flaws as CVE-2026-109618 and CVE-2026-109619, dated the patch-server shutdown to October 21, and reported that Square Enix expected logins to return on October 22, roughly 18 hours after they closed.
Umamusume: Pretty Derby was taken down completely. Its server-side infrastructure uses PHP, so an unscheduled maintenance outage was put in place, though the developer told players no exploitation of the vulnerability had occurred. Eurogamer reported that the Japanese and global servers are back online and that a compensatory package of in-game currency has been sent to all players.
Path of Titans, an in-beta dinosaur MMO, was still down at the time of Eurogamer's report. Developer Alderon Games said on X that the game and its website had been taken offline for up to three days as a precautionary measure, and that no player data had been compromised.
Locked-out players and a watering service
Pulling Final Fantasy 14's patch servers shut out anyone who had already logged off, leaving the players who happened to still be in-game wandering near-empty housing wards. Dexerto reported that Square Enix paused housing demolition timers as a precaution.
Players also organised around the gap. Dexerto reported that a Reddit post titled "PHP Watering Service" collected ward and plot numbers from locked-out players — Final Fantasy 14 housing is addressed that way — so that those still online could fan out and water whatever gardens needed it, without asking for payment.
The stakes were not trivial. As Dexerto noted, Thavnarian Onion seeds require cross-breeding and then five full days of growth, so a single missed evening of watering could cost a player weeks of work. Eurogamer reported that a fix for the vulnerability was in circulation at the time of writing, and that services far beyond the games industry had taken infrastructure offline in response.
