Cygames Titles Hold Emergency Maintenance over Critical PHP Flaws
The responses differ by service: Cygames titles handled it on their own schedules, CHUNITHM limited the impact to web services, and the OBS Studio team said streaming itself is unaffected while part of its site goes offline, so the PHP dependency is being handled across gaming web infrastructure unevenly.
Key Facts
- The PHP Group confirmed two critical PHP vulnerabilities on October 20, both rated 9.2 on CVSS v4.0, with a security release scheduled for 23:00 JST on October 21.
- Uma Musume Pretty Derby moved its emergency maintenance start to around 22:00 on October 21 to apply the PHP fix.
- Granblue Fantasy scheduled emergency maintenance from 22:00 on October 21 to 07:00 on October 22.
- Niconico began maintenance at 19:00 on October 21, and Bandai Channel started at 20:00; neither had an end time set.
- The IPA said it has not confirmed any attacks exploiting the vulnerabilities and that the warning is preventive.
Reporting from 4 sources: Denfaminicogamer, GIGAZINE, Inside, Game Spark.
The PHP Group confirmed two critical vulnerabilities in PHP on October 20 and scheduled a security release for 23:00 JST on October 21. Both are rated 9.2 on CVSS v4.0. In response, Cygames titles including Uma Musume Pretty Derby, Granblue Fantasy and Shadowverse: Worlds Beyond announced emergency maintenance centered on the patch's release. Uma Musume later moved its start to around 22:00, while Granblue Fantasy runs from 22:00 October 21 to 07:00 October 22. Shadowverse: Worlds Beyond has no set end time. Heaven Burns Red planned maintenance from after 22:30. Dolphin Wave, developed by Marvelous and HONEY∞PARADE GAMES, announced maintenance from around 23:00, and Sega's CHUNITHM will service CHUNITHM-NET and its official site, but arcade cabinet play using Aime remains possible. IPA says no exploitation has been confirmed and issued the warning as a precaution. The PHP Group says affected versions will be disclosed with the release.
Cygames was not the only operator acting. Bushiroad, BOOTH, Daiyon Kyokai and Bandai Channel also announced or began emergency maintenance on their official sites. The coordination came from the National Cybersecurity Office, which posted on X: "Please check whether the websites you publish use PHP, and prepare so that the fix patch to be released at 11:00 p.m. on October 21 (Japan time) can be applied as soon as possible."
The Shadowverse: Worlds Beyond operation team said it heard from The PHP Group around 1:00 on October 21 about a vulnerability in the PHP used on its servers, and that no damage or user data leaks had been confirmed. Princess Connect! Re:Dive also announced maintenance.
Outside gaming, the patch window pulled several large Japanese web services offline on October 21:
- Niconico: maintenance began at 19:00, no end time set; the Niconico Video app showed a maintenance screen on launch.
- Bandai Channel: maintenance from 20:00, no end time set.
- Melonbooks: maintenance from around 17:30 to around 10:00 on October 22.
- BASE: maintenance from 15:50, end scheduled for 7:00 on October 22.
- pixiv: maintenance until the early hours of October 22.
- BOOK☆WALKER: store suspended until the early morning of October 22.
- Animate's online store: entered emergency maintenance.
- Pokemon Sleep: emergency maintenance from 23:00, end time undecided.
The PHP Group said the release could move earlier if details of the vulnerabilities become public or evidence of exploitation is confirmed.
Synthesized by Yomimono from the 4 cited sources below, including Japanese-language reporting where cited, then editorially reviewed before publishing.
Sources
- Denfaminicogamer 『ウマ娘』や『グラブル』が「PHP」の重大な2件の脆弱性に関する発表で緊急メンテ。「ブシロード」「バンダイチャンネル」「ニコニコ」などの公式サイトにも影響、修正版は10月21日23時に公開予定
- GIGAZINE PHPが緊急アップデート「8.5.12」「8.4.27」「8.3.36」「8.2.35」をリリース
- Inside 「PHP」重大脆弱性がゲーム業界にも影響―『ウマ娘』『グラブル』『ヘブバン』『チュウニズム』などが緊急メンテへ。深刻度9.2の脆弱性2件で
- Game Spark 「PHP」重大脆弱性がゲーム業界にも影響―『ウマ娘』『グラブル』『ヘブバン』『チュウニズム』などが緊急メンテへ。深刻度9.2の脆弱性2件で