Two Japanese online games to end service over PHP2Shell flaw

The operator of World Quest announced on October 21, 2026 that the game's service ended that day, because the critical PHP vulnerability known as PHP2Shell could not be adequately addressed on its old system, according to gamebusiness.jp. JAGS said on October 22, 2026 that its smartphone game Boku no Makai wo Sukutte! will also end service, as handling the same flaw had become difficult.

The PHP development team published fixes for CVE-2026-109618 and CVE-2026-109619, both rated 9.2 on CVSS v4.0, in versions 8.2.35, 8.3.36, 8.4.27 and 8.5.12. The IPA and the National Cybersecurity Office issued advisories about the vulnerability.

Larger operators also responded. On the night of October 21, 2026, Cygames titles including Uma Musume Pretty Derby and Granblue Fantasy began emergency maintenance. Shadowverse: Worlds Beyond announced the end of its maintenance in the early hours of October 22, and Princess Connect! Re:Dive finished at 2:10, followed by Uma Musume Pretty Derby at 2:30. Granblue Fantasy ended maintenance at 7:00 on October 22, though the DMM and GREE versions were not covered at that point.

Japan's prime minister also urged users to apply the fix in a post on X.

Older titles affected

World Quest launched on GREE in 2011 and was also offered on Mobage. It ended service once in May 2019 and was revived in May 2020 so people could travel in-game during the pandemic. Boku no Makai wo Sukutte! debuted in 2011 as an idle-style fantasy simulation RPG.