PHP Security Flaw Takes Down Pokemon Champions, Home and Sleep
Three Pokémon services went offline at the same time on October 22, with login pages for Pokémon Champions, Pokémon Home and Pokémon Sleep all displaying maintenance notices. According to the source report, the shutdown has nothing to do with a version update or routine feature checks. Instead, it stems from a security vulnerability disclosed in the PHP programming language, the server-side technology that powers a large share of sites and applications worldwide.
PHP is used by roughly 70 percent of websites and applications around the world, with a history that stretches back to the 1990s. The reported scope of this vulnerability is unusually wide, potentially covering PHP 5, which launched in 2004. A fix patch was released on Wednesday, but security guidance still recommends that any platform running PHP temporarily shut down its services and complete a risk assessment before returning to normal operation.
Video game services were not the only ones affected. Government platforms in multiple countries and sections of the BBC website also chose to take affected content offline temporarily in order to avoid the risk of a hacker attack. That broader response underlines how far the dependency on PHP reaches, and why operators of large public-facing services have been cautious about staying online while checks are carried out.
For now, The Pokémon Company has not announced a precise time for services to return. Until the company confirms the environment is secure enough, players cannot climb the ranks in Pokémon Champions, tidy up their storage in Pokémon Home, or feed berries to Snorlax in Pokémon Sleep. It is a frustrating pause for the community, but opting for caution over convenience is the sensible call here — an outage beats a compromised account.
