The PHP programming language, used on all manner of websites and apps, has been found to contain two extremely serious vulnerabilities. So serious, in fact, that various worldwide governments have taken down their websites, rather than leave them open to potential attacks as soon as the fixes are rolled out and the nature of the weaknesses are exposed. Other sites like DeviantArt and Ars Technica have also temporarily become inaccessible in preparation for the updates, with international cybersecurity agencies encouraging sites using PHP (which includes as much as 70 percent of the internet) to take themselves offline. It seems that The Pokémon Company has heeded these warnings, with apps like Pokémon Home, Pokémon Champions, and Pokémon Sleep currently down.
Trying to run Pokémon Home on my phone right now results in a Japanese error message that doesn’t resolve, translating to “We are currently under maintenance. Please wait a moment until maintenance is finished.” Pokémon Champions, meanwhile, looks like it’s going to run, but then pops up with a message warning, “Emergency maintenance is currently ongoing.” Neither gives any idea how long they’ll be offline.
Multiple Pokémon games have been taken offline including Pokémon HOME, Champions, Sleep due to a just released critical exploit found in PHP, a programming language used by a big number of web servers.
— Centro LEAKS (@CentroLeaks) October 21, 2026
As awareness of the severity of the PHP exploit spreads around the world, expect many more sites and apps to temporarily stop working. The vulnerability, which is said to affect versions of PHP dating back as far as PHP 5 from 2004, allows nefarious actors to execute commands on web servers running the scripting language, and then perform any task the hacker asks of it. Which is to say, it’s extremely serious, allowing outsiders to run remote code like malware. The exploits have now been fixed, but the patches need to be applied at every level before servers and sites are safe, inevitably leaving millions of sites in danger of attack.
This gets more complicated with third-party software companies needing to update their own tech using PHP. As the UK’s National Cyber Security Centre says, “If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.”
