{"rewrite":{"id":"r_0ef2d43981bd01f892a03379","clusterId":"c_7597e602be519d78d0be26f9","slug":"cygames-titles-hold-emergency-maintenance-over-critical-php-flaws","model":"deepseek-v4-1-flash","headline":"Cygames Titles Hold Emergency Maintenance over Critical PHP Flaws","summary":"The PHP Group confirmed two critical vulnerabilities in PHP on October 20 and scheduled a security release for 23:00 JST on October 21. Both are rated 9.2 on CVSS v4.0. In response, Cygames titles including Uma Musume Pretty Derby, Granblue Fantasy and Shadowverse: Worlds Beyond announced emergency maintenance centered on the patch's release. Uma Musume later moved its start to around 22:00, while Granblue Fantasy runs from 22:00 October 21 to 07:00 October 22. Shadowverse: Worlds Beyond has no set end time. Heaven Burns Red planned maintenance from after 22:30. Dolphin Wave, developed by Marvelous and HONEY∞PARADE GAMES, announced maintenance from around 23:00, and Sega's CHUNITHM will service CHUNITHM-NET and its official site, but arcade cabinet play using Aime remains possible. IPA says no exploitation has been confirmed and issued the warning as a precaution. The PHP Group says affected versions will be disclosed with the release.","whyItMatters":"The responses differ by service: Cygames titles handled it on their own schedules, CHUNITHM limited the impact to web services, and the OBS Studio team said streaming itself is unaffected while part of its site goes offline, so the PHP dependency is being handled across gaming web infrastructure unevenly.","webCardHtml":"\u003cp\u003eCygames was not the only operator acting. Bushiroad, BOOTH, Daiyon Kyokai and Bandai Channel also announced or began emergency maintenance on their official sites. The coordination came from the National Cybersecurity Office, which posted on X: \u0026#34;Please check whether the websites you publish use PHP, and prepare so that the fix patch to be released at 11:00 p.m. on October 21 (Japan time) can be applied as soon as possible.\u0026#34;\u003c/p\u003e\n\u003cp\u003eThe Shadowverse: Worlds Beyond operation team said it heard from The PHP Group around 1:00 on October 21 about a vulnerability in the PHP used on its servers, and that no damage or user data leaks had been confirmed. Princess Connect! Re:Dive also announced maintenance.\u003c/p\u003e\n\u003cp\u003eOutside gaming, the patch window pulled several large Japanese web services offline on October 21:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eNiconico: maintenance began at 19:00, no end time set; the Niconico Video app showed a maintenance screen on launch.\u003c/li\u003e\n\u003cli\u003eBandai Channel: maintenance from 20:00, no end time set.\u003c/li\u003e\n\u003cli\u003eMelonbooks: maintenance from around 17:30 to around 10:00 on October 22.\u003c/li\u003e\n\u003cli\u003eBASE: maintenance from 15:50, end scheduled for 7:00 on October 22.\u003c/li\u003e\n\u003cli\u003epixiv: maintenance until the early hours of October 22.\u003c/li\u003e\n\u003cli\u003eBOOK☆WALKER: store suspended until the early morning of October 22.\u003c/li\u003e\n\u003cli\u003eAnimate\u0026#39;s online store: entered emergency maintenance.\u003c/li\u003e\n\u003cli\u003ePokemon Sleep: emergency maintenance from 23:00, end time undecided.\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThe PHP Group said the release could move earlier if details of the vulnerabilities become public or evidence of exploitation is confirmed.\u003c/p\u003e","blueskyPost":"The PHP flaws are rated 9.2, yet IPA has confirmed no exploitation. Cygames is scheduling Uma Musume Pretty Derby maintenance against a patch that lands at 23:00 JST, before it can know which PHP versions are affected.","twitterPost":"Cygames is booking Granblue Fantasy maintenance against a PHP patch that lands 23:00 JST, before PHP Group says which versions are affected.","threadsPost":"Granblue Fantasy and Uma Musume Pretty Derby are going into emergency maintenance for fixes PHP Group has not fully published yet. The 23:00 JST release will disclose affected versions at the same moment Cygames is patching. IPA says no exploitation is confirmed.","newsletterBlurb":"Two critical PHP flaws rated 9.2 on CVSS v4.0 forced emergency maintenance across Cygames titles, Niconico, Bandai Channel and more on October 21. The fix is scheduled for 23:00 JST, with start times varying by service. IPA says no exploitation has been confirmed.","attributionJson":"[{\"source\":\"Denfaminicogamer\",\"url\":\"https://news.denfaminicogamer.jp/news/2610213b\",\"title\":\"Uma Musume, Granblue, and Others Hold Emergency Maintenance Following Announcement of Two Critical PHP Vulnerabilities; Official Sites of Bushiroad, Bandai Channel, Nico Nico, and More Also Affected; Fixed Version Scheduled for Release at 23:00 on October 21\"},{\"source\":\"Game Spark\",\"url\":\"http://www.gamespark.jp/article/2026/10/21/173908.html\",\"title\":\"Critical PHP Vulnerability Affects Game Industry - Uma Musume, Granblue, Heaven Burns Red, CHUNITHM and Others Hold Emergency Maintenance; Two Vulnerabilities Rated 9.2 Severity\"},{\"source\":\"GIGAZINE\",\"url\":\"https://gigazine.net/news/20261021-php-php2shell-maintenance/\",\"title\":\"Niconico, pixiv, and various other websites and apps undergo maintenance to apply emergency PHP patch\"},{\"source\":\"Inside\",\"url\":\"https://www.inside-games.jp/article/2026/10/21/189615.html\",\"title\":\"Serious PHP Vulnerability Affects Game Industry: Uma Musume, Granblue, Heaven Burns Red, CHUNITHM and Others Hold Emergency Maintenance; Two Vulnerabilities Rated 9.2 Severity\"}]","lintFlagsJson":null,"lintHits":0,"costUsd":0,"inputTokens":17230,"outputTokens":1641,"status":"published","repairAttempts":0,"nextRepairAt":null,"factsAttemptedAt":1792589828,"createdAt":"2026-10-21T13:31:54.000Z","publishedAt":"2026-10-21T13:36:05.000Z","updatedAt":"2026-10-21T13:36:05.000Z"},"cluster":{"id":"c_7597e602be519d78d0be26f9","canonicalTitle":"『ウマ娘』や『グラブル』が「PHP」の重大な2件の脆弱性に関する発表で緊急メンテ。「ブシロード」「バンダイチャンネル」「ニコニコ」などの公式サイトにも影響、修正版は10月21日23時に公開予定","representativeArticleId":"a_ef8a970f93f9fe72de776b52","sourceCount":4,"writtenSourceCount":4,"writeAttempts":0,"isSolo":false,"entitiesJson":"{\"anime_titles\":[],\"manga_titles\":[],\"work_titles\":[\"Uma Musume Pretty Derby\",\"Granblue Fantasy\",\"Heaven Burns Red\",\"Chunithm\"],\"studios\":[],\"people\":[],\"type\":\"news\",\"domain\":\"games\",\"is_roundup\":false}","contentType":"news","status":"published","firstSeenAt":"2026-10-21T11:26:18.000Z","lastSeenAt":"2026-10-21T14:44:45.000Z","updatedAt":"2026-10-21T14:50:23.000Z"},"attribution":[{"source":"Denfaminicogamer","url":"https://news.denfaminicogamer.jp/news/2610213j","title":"「PHP」の重大な脆弱性を修正する更新プログラムが公開。国家サイバー統括室が速やかな適用を呼びかけ"},{"source":"GIGAZINE","url":"https://gigazine.net/news/20261021-php-critical-vulnerabilities/","title":"PHPが緊急アップデート「8.5.12」「8.4.27」「8.3.36」「8.2.35」をリリース"},{"source":"Inside","url":"https://www.inside-games.jp/article/2026/10/21/189615.html","title":"「PHP」重大脆弱性がゲーム業界にも影響―『ウマ娘』『グラブル』『ヘブバン』『チュウニズム』などが緊急メンテへ。深刻度9.2の脆弱性2件で"},{"source":"Game Spark","url":"http://www.gamespark.jp/article/2026/10/21/173908.html","title":"「PHP」重大脆弱性がゲーム業界にも影響―『ウマ娘』『グラブル』『ヘブバン』『チュウニズム』などが緊急メンテへ。深刻度9.2の脆弱性2件で"}],"entities":{"anime_titles":[],"manga_titles":[],"work_titles":["Uma Musume Pretty Derby","Granblue Fantasy","Heaven Burns Red","Chunithm"],"studios":[],"people":[],"type":"news","domain":"games","is_roundup":false},"keyFacts":["The PHP Group confirmed two critical PHP vulnerabilities on October 20, both rated 9.2 on CVSS v4.0, with a security release scheduled for 23:00 JST on October 21.","Uma Musume Pretty Derby moved its emergency maintenance start to around 22:00 on October 21 to apply the PHP fix.","Granblue Fantasy scheduled emergency maintenance from 22:00 on October 21 to 07:00 on October 22.","Niconico began maintenance at 19:00 on October 21, and Bandai Channel started at 20:00; neither had an end time set.","The IPA said it has not confirmed any attacks exploiting the vulnerabilities and that the warning is preventive."]}