Pokémon Apps Go Offline Over PHP Security Flaws
The Pokémon Company pulls services to address critical remote code execution vulnerabilities in the legacy programming language.
Updated on Oct. 21, 2026 in Cybersecurity
Live Poll
Do you support apps going offline temporarily to prevent cyber attacks?
The Pokémon Company has taken services including Pokémon Home, Pokémon Champions, and Pokémon Sleep offline in response to critical security vulnerabilities in the PHP programming language. These vulnerabilities allow for remote code execution on affected servers.
Why it matters
The move reflects a broader industry response to vulnerabilities in PHP, a language powering roughly 70% of the internet. International cybersecurity agencies have issued warnings urging operators of PHP-based sites to take them offline to mitigate risks.
The vulnerability enables remote code execution, a mechanism that permits unauthorized actors to run arbitrary commands on web servers. These flaws affect PHP versions dating back to 2004, creating a significant attack surface across the web.
The players
The Pokémon Company
An entertainment firm that develops and manages the global Pokémon gaming franchise and its associated digital service ecosystem.
The details
The vulnerabilities allow external actors to bypass security controls and execute malicious commands directly on the server host. Because PHP is a server-side scripting language—code that runs on the web server rather than the user's device—a compromise can grant attackers control over the application environment. Affected applications currently display maintenance messages to users while developers work to secure their infrastructure.
Timeline
Vulnerabilities affect PHP versions dating back to 2004.
The Pokémon Company services were offline as of October 21, 2026.
The Tech Race
This development follows a series of worldwide government mandates to secure web infrastructure against long-standing vulnerabilities in the PHP runtime. It highlights the systemic risk inherent in languages that have sustained the web since the early 2000s.
Users of Pokémon Home, Pokémon Champions, and Pokémon Sleep will be unable to access their data or services until the maintenance period concludes. While other websites may also experience intermittent outages as operators apply patches, there is currently no set date for when these services will resume.
The takeaway
The event underscores the security fragility of widely used, long-standing server-side languages. Users should monitor official announcements from The Pokémon Company for updates on service restoration status.
Further reading
For broader trends in digital infrastructure security, see our coverage of Cybersecurity.
Live Poll
Do you support apps going offline temporarily to prevent cyber attacks?
