Final Fantasy 14 Logins Suspended Since October 21 Over PHP Flaw

Final Fantasy 14 stopped letting new players log in on October 21, 2026, and its forums went dark for a day and a half, because the website software underneath it has a flaw bad enough that the PHP project put a critical remote code execution warning at the top of its own site. Square Enix suspended new logins across all worlds for roughly a day, from October 21 to October 22, and is paying affected players for the lost time. Its save-data backup service resumed around 1:35 a.m. PDT on October 23.

The fault sits in PHP, the language a large share of the web runs on. In a security advisory published October 21, the PHP project said two critical vulnerabilities can let an unauthenticated request run code. One, CVE-2026-109618, triggers when an out-of-memory failure interrupts PHP while request data is only partly initialized. The other, CVE-2026-109619, leaves request state behind after its memory has been freed, so a later request handled by the same worker can pick it up. The project calls the risk highest for mod_php setups, where it says there is a demonstrated exploit that fires before any application code runs. Fixes ship in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.

Square Enix’s own English site lists the damage. New logins were suspended across all worlds for about a day, from October 21 to October 22, and the game is granting one day of game time to accounts with an active subscription on either of those dates. That compensation goes out sequentially from 12:00 a.m. PDT on October 28 and Square Enix expects it to take two to three days; the notice says it covers the global version and that other regions may handle it differently. The forums were offline from 8:50 a.m. PDT on October 21 until 9:45 p.m. PDT on October 22, and the server backup feature for save data resumed around 1:35 a.m. PDT on October 23 once the security work was done. Our Final Fantasy 14 maintenance guide tracks the next scheduled downtime.

Japanese services took the biggest hits. In a roundup published October 23, 4Gamer reports Cygames ran emergency maintenance on Umamusume: Pretty Derby, Granblue Fantasy, Shadowverse: Worlds Beyond and Princess Connect Re:Dive and has since restored them. DMM Games and FANZA Games were down from 10 p.m. JST on October 21 until the evening of the 22nd. Sony took its Store and My Sony offline overnight, with no confirmed interruption to PlayStation Store downloads, and Sega’s product information site came back at 11:30 a.m. JST today. Bushiroad lost its tournament management service and deck-building tool, with events on October 22 and 23 called off. Arc System Works announced this morning that it is taking every website and web service it runs offline, with no end time set. Its Japanese site, arcsystemworks.co.jp, was not responding when we checked.

What this means for you

Nothing to download and nothing to patch at home. The PHP team’s fix is a server-side update, and its interim advice is to change a setting and restart the workers. What goes dark when a publisher takes its site offline is everything it hosts on the web: forums, account pages, ticket systems, event sign-ups and, in Final Fantasy 14’s case, save-data backups. The two services giving up rather than patching, the browser game World Quest and the long-running idle RPG Boku no Makai wo Sukue, are the ones worth remembering.

The afternoon-long outages are the boring part. The interesting part is the pair of games that decided closing was cheaper than securing, and a company behind the Guilty Gear series choosing to sit dark indefinitely rather than guess. Both decisions say the same thing about decade-old web infrastructure: nobody wants to own it. The habit worth keeping is simple. Check the official account for the game before assuming you have been banned or that your save is gone, because a maintenance notice and a security outage look identical from the outside.

Edited by Kerwin Stewart, Editor-in-Chief · How we report