Several Pokémon Apps Shut Down Amid Concerns Over PHP Cyber Attack

The PHP programming language, widely used across various websites and applications, has been discovered to have two critical vulnerabilities. These issues are so severe that numerous governments around the globe have opted to take their websites offline to prevent potential attacks while fixes are being developed and the details of the vulnerabilities are disclosed. Other platforms have also temporarily gone dark in anticipation of necessary updates, with international cybersecurity agencies urging any site utilizing PHP—accounting for about 70 percent of the internet—to go offline. The Pokémon Company appears to be following suit, as apps like Pokémon Home, Pokémon Champions, and Pokémon Sleep are currently unavailable.

Attempting to access Pokémon Home on my phone results in a Japanese error message that translates to, “We are currently under maintenance. Please wait a moment until maintenance is finished.” Pokémon Champions seems like it might launch, but then displays a message stating, “Emergency maintenance is currently ongoing.” Unfortunately, neither app provides an estimate for when they will be back online.

Multiple Pokémon titles, including Pokémon HOME, Champions, and Sleep, have been taken offline due to a recently discovered critical exploit in PHP, a programming language used by a significant number of web servers.

As the implications of the PHP exploit become more widely recognized, expect many more sites and applications to temporarily cease operations. This vulnerability, affecting PHP versions dating back to 2004, allows malicious actors to execute commands on web servers running the language, enabling them to perform any action they desire. In other words, it’s a serious threat that permits outsiders to run remote code, including malware. While fixes have been developed, they must be implemented across all systems before any site can be deemed secure, leaving millions of sites vulnerable to attacks.

The situation is further complicated by the need for third-party software companies to update their own PHP-based technologies. As noted by the UK’s National Cyber Security Centre, “If you are unable to apply the temporary mitigations, or applying them would take too long, you should consider taking the system offline until it can be fully mitigated.”