Final Fantasy XIV Closed the Door, Not the World

Square Enix did not have to take Eorzea offline to take PHP offline. It stopped new logins.

On 21 October the Lodestone notice for Final Fantasy XIV said new logins were temporarily suspended across all worlds to address a critical vulnerability in PHP, the language hitting systems worldwide. Secondary reports the same day said people already logged in could keep playing, and that there was no public return time on the notice.

That split is the story. A game login service is a web front on a live world. You can refuse the next authentication without dumping every character who is already past the gate. It is still an outage. Anyone who disconnected, anyone on a new session, anyone who needed the web layer, was stuck. It is a narrower outage than "the game is gone," and it is a more honest one than leaving the login form up on a runtime PHP had just called unsafe.

What this is not

This post is not a claim that Square Enix was breached through PHP2Shell. The notice that was public on 21 October is a maintenance action tied to the PHP flaw. Account-security warnings from earlier in the month are a different incident. Do not merge them in the headline.

PHP's fixes that day were 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Until those, or a vendor build that contains the same fix, are the binaries behind the login service, a suspended login is the correct product decision. Opening the form early because players are angry is how a maintenance window becomes an incident report.

If you ship a game, a store, or a course site with a PHP login in front of a system that can survive without new sessions, copy this shape. Freeze new auth. Say why in one sentence. Do not invent an end time you do not have. Bring the form back only after the worker restart, not after the package download.

Sources: FINAL FANTASY XIV Lodestone notice, 21 October 2026; PHP advisory.