Pokémon Home Went Down With the PHP Patch

Pokémon did not get a neat single-paragraph post in the first wave of PHP2Shell coverage. It got a list, and the list is still worth a post if you label it as a list.

On 21 October, GoNintendo and Dexerto reported that Pokémon Home, Pokémon Champions, and Pokémon Sleep were offline, and that the official Pokémon Japan site was down with them. The cause they gave was the same pair of critical PHP flaws that had already pulled Umamusume, Final Fantasy XIV logins, and a pile of government sites. I have not opened a first-party Pokémon notice for this draft. If you have the official post, swap this paragraph for a quote and a link before you publish. If you cannot find one, say "reported" in the first sentence and do not upgrade it to "Pokémon confirmed."

Why it still belongs in the six

Home is not a marketing site. It is the box where creatures, and the account around them, live. Sleep and Champions are live services with logins. Taking those down on patch day is the same decision Saylor made for certificates and Logius made for DigiD: the data is worth more than the uptime, and the bug is in the language, not in one route you can feature-flag off.

PHP's position on 21 October was blunt. Every PHP install serving web requests was in scope. The highest risk they called out was mod_php, where an unauthenticated request can hit the bug before application code runs. A game studio cannot audit its way out of that in an afternoon. It can pull the service, install 8.5.12, 8.4.27, 8.3.36, or 8.2.35, restart the workers, and reopen.

How to end the series

Six orgs, one pattern. Saylor told learners the grades were safe and the login was not. Logius told a country the identity site was a precaution. Wikimedia could patch its own stack and still had to darken Toolforge. Square Enix froze new sessions. Cygames moved the start time when the patch moved. Pokémon's live services showed up on the same day, in the same bucket.

None of these posts are a breach report. Do not write them as one. The publishable fact is the outage, the clock, and the version that has to be running before the hostname comes back.

Sources: GoNintendo, 21 October 2026; Dexerto; PHP advisory.