Several Pokémon services have been taken offline while operators respond to two critical security vulnerabilities in PHP, the programming language used across websites and online applications.
The weaknesses are considered serious enough that various worldwide governments have taken down their websites. DeviantArt and Ars Technica have also temporarily become inaccessible as organisations prepare to install security updates. Cybersecurity agencies are encouraging sites that rely on PHP to go offline where necessary, with the technology estimated to be used by as much as 70 per cent of the internet.
The Pokémon Company appears to have followed that advice. Pokémon HOME, Pokémon Champions and Pokémon Sleep are currently unavailable.
Pokémon services show maintenance messages
Opening Pokémon HOME on a phone produces a Japanese error message that translates as: “We are currently under maintenance. Please wait a moment until maintenance is finished.”
Pokémon Champions initially appears to load, but then displays a warning stating: “Emergency maintenance is currently ongoing.” Neither service provides an estimated return time.
Multiple Pokémon games have been taken offline including Pokémon HOME, Champions, Sleep due to a just released critical exploit found in PHP, a programming language used by a big number of web servers.
— Centro LEAKS, October 21, 2026
Why the PHP vulnerabilities are dangerous
The vulnerabilities reportedly affect PHP versions reaching back to PHP 5, first released in 2004. They can allow attackers to execute commands on affected web servers, potentially giving them the ability to run malicious code or carry out other actions remotely.
Although fixes are available, they must be applied throughout the relevant server and software infrastructure. Until that process is complete, millions of websites and services may remain exposed to attack. This helps explain why some operators have chosen temporary shutdowns rather than risk leaving systems online.
Third-party software adds another layer
The response is more complicated for organisations that depend on third-party software built with PHP. Those suppliers may need to update their own systems before a service can be fully secured.
The UK’s National Cyber Security Centre advises organisations that cannot apply temporary mitigations quickly enough to consider taking affected systems offline until they are fully protected. More services could therefore experience interruptions as the PHP security response continues.
For arcade operators and enthusiasts, the incident is a reminder that connected services matter even when the visible hardware is a cabinet, controller or display. Our arcade news and editorial coverage explores developments across the wider games industry, while the arcade machine buying guide explains the key considerations when choosing a machine. Those planning a home setup can also browse arcade machines.
Leave a Reply