Global Web Outage: Critical PHP Flaws Force Pokémon Apps and Government Sites Offline

Key points

• The Pokémon Company took Pokémon Home, Champions, and Sleep offline on October 21, 2026, citing emergency maintenance due to critical PHP vulnerabilities.
• The flaws, discovered by cybersecurity firms Calif and Wiz using AI, allow unauthenticated remote code execution and affect PHP versions from 2004 onward.
• Governments in Finland, the Netherlands, and the UK, along with entities like the BBC and Wikipedia, have taken sites offline or are patching systems to mitigate the risk.
• Cybersecurity agencies advise organizations unable to patch immediately to take systems offline, as early attacks are already emerging.
• The PHP Foundation has issued updates for the latest versions, urging users of PHP 8.1 or older to upgrade to ensure safety.

Background

This incident follows a broader trend of AI-enabled cyber threats, including a recent cybersecurity emergency in Japan linked to AI-driven attacks on major corporations. The current PHP crisis highlights the persistent risks of legacy code, as the vulnerabilities have gone undetected for over a decade despite PHP’s widespread use in web development.

How outlets are covering it

Kotaku emphasizes the immediate impact on consumer-facing apps like Pokémon, noting that users are seeing maintenance messages with no clear timeline for restoration. BBC highlights the broader geopolitical and infrastructure implications, detailing how governments and major institutions like the White House and Wikimedia Foundation are responding. While Kotaku focuses on the user experience of downtime, BBC underscores the severity of the threat, noting that the vulnerabilities were discovered by AI and are described as the 'most severe' ever found by such technology. Both sources agree on the urgency of the situation but differ in their focus: Kotaku on specific app outages, BBC on the global scale and AI-driven discovery.

Why it matters

The PHP vulnerabilities expose the fragility of the internet’s foundational infrastructure, as the language powers a significant portion of global web services. The incident underscores the risks of relying on legacy systems and the growing role of AI in both discovering and exploiting security flaws. As early attacks emerge, organizations face a critical window to patch systems before widespread exploitation, potentially leading to data breaches and service disruptions on a massive scale.

What to watch

Organizations are expected to continue patching systems over the coming days, with cybersecurity agencies monitoring for signs of exploitation. The PHP Foundation will likely release further updates for older versions, while governments may issue additional guidance on mitigating the risk. As the internet gradually comes back online, experts will assess the extent of any breaches and the effectiveness of the patches in preventing further attacks.