PHP zero-day advisory triggers emergency maintenance across game services
PHP's security team rated two vulnerabilities 9.2 under CVSS v4.0; a fix is due at 23:00 Japan time on October 21.
Several game titles and company websites announced emergency maintenance on October 20, after the PHP security team issued an advisory about two critical vulnerabilities. A security release fixing both flaws is scheduled to be published at 23:00 Japan time on October 21, according to news.denfaminicogamer.jp.
The two vulnerabilities were both rated 9.2 under CVSS v4.0. The PHP security team urged all PHP users to prepare to upgrade as soon as the release is published, and said a fix could arrive earlier if details of the flaws become public or evidence of exploitation is confirmed.
Details including affected and patched versions will be announced when the release is published.
Uma Musume Pretty Derby announced emergency maintenance to ensure system safety in response to the advisory. Granblue Fantasy, Shadowverse: Worlds Beyond and Princess Connect! Re:Dive also announced maintenance.
Bushiroad, BOOTH, Niconico, Daiyon Kyokai, OBS and Bandai Channel announced or began emergency maintenance of their official sites.
Quick answers
When will the PHP security release be published?
It is scheduled for 23:00 Japan time on October 21, though the PHP security team said it could come earlier if details become public or exploitation is confirmed.
How severe are the two PHP vulnerabilities?
Both are rated 9.2 under CVSS v4.0, according to the advisory issued on October 20.
Which games announced emergency maintenance?
Uma Musume Pretty Derby, Granblue Fantasy, Shadowverse: Worlds Beyond and Princess Connect! Re:Dive announced maintenance.