Final Fantasy 14 has blocked new logins across all worlds while Square Enix secures its patch servers against a critical PHP vulnerability. The October 21 disruption comes as Pokémon HOME, Pokémon Champions, Pokémon Sleep and Umamusume: Pretty Derby also undergo emergency maintenance.

Square Enix's notice identifies the patch servers as the systems it has taken offline, with new logins unavailable as a result. Players already logged into FF14 can continue playing. The company has not given a restoration time and says it will issue another update when it has made progress.

Other games affected by emergency maintenance

Umamusume's official English account announced maintenance beginning around 14:00 UTC on October 21 to address the PHP vulnerability. Its restrictions cover both playing the game and related functions, including data linking.

For Pokémon, Nintendo Everything reports that HOME, Champions and Sleep are unavailable. HOME displays a maintenance message, while Champions can open before showing an emergency-maintenance warning. Neither HOME nor Champions provides an estimated return time in those messages. The Pokémon outages coincide with the PHP security response, though that report does not establish a confirmed technical cause for each service.

PHP fixes are out, but servers still need updating

The security issue has prompted action well beyond games. In its October 21 alert, US cybersecurity agency CISA urges organizations to patch two flaws, CVE-2026-109618 and CVE-2026-109619. They can let an attacker run code on an affected server without authenticating.

CERT-EU says PHP fixes were released at 13:30 UTC on October 21. That does not automatically restore affected games: operators still have to apply the updates. CISA recommends taking PHP-based systems offline if they cannot be updated immediately, and said it had not observed exploitation when its alert was published.

The emergency work also follows Square Enix's earlier warning about unauthorized account access. That warning concerned credentials apparently obtained from other companies' services. The new maintenance notice cites the PHP vulnerability; it does not announce that FF14 player data has been stolen or link the outage to those account attacks.