A wave of critical PHP vulnerabilities prompted temporary outages for several Pokémon services, including Pokémon HOME and Pokémon Sleep, after web operators moved to mitigate risk.
The affected services are run by The Pokémon Company and support platforms including mobile devices and, in the case of Pokémon HOME, Nintendo Switch integration.
Security agencies worldwide disclosed two serious vulnerabilities in PHP, the widely used web scripting language.
PHP powers a large portion of the internet—widely cited industry figures place its usage at roughly 70% of websites—and the reported flaws trace back to PHP 5-era code introduced in 2004.
The vulnerabilities could allow remote command execution on poorly patched servers, a high-severity outcome that prompted urgent remediation guidance.
Multiple public-sector organizations were reported to have temporarily taken pages offline while fixes were applied.
According to the BBC, some organizations—including the Finnish government, Edinburgh City Council, and the BBC itself—pulled affected pages offline as a precaution.
Cybersecurity agencies recommended that organizations unable to apply immediate patches consider taking public-facing systems offline until updates could be deployed.
Media outlets covering the outage reported that Pokémon services showed maintenance messages.
Kotaku noted that accessing Pokémon HOME returned a persistent Japanese maintenance notice the site translated as: “We are currently under maintenance.
Please wait a moment until maintenance is finished.” Pokémon Champions initially launched but then displayed a message indicating “Emergency maintenance is currently ongoing.” Neither app provided an estimated restoration time at the time of reporting.
Pokémon Sleep was also reported unavailable.
Patches addressing the PHP flaws have been published, and sources including the BBC reported that an update was released to mitigate the issue.
However, remediation requires system administrators to apply those patches across affected servers and infrastructure; until updates are widely installed, exposed services can remain vulnerable.
For players and developers, the immediate facts are clear: The Pokémon Company temporarily took affected services offline in response to a validated, high-severity PHP vulnerability, third-party reporting confirmed maintenance messages on multiple apps, and security patches have been issued.
Stakeholders should monitor official channels—The Pokémon Company notices, the Nintendo eShop/ Nintendo Switch service pages, and reputable news outlets like the BBC—for restoration updates and follow guidance from their IT teams if they manage web infrastructure.
We will update this story as official statements and restoration timelines become available.
For more Nintendo coverage and service-status updates, check official Nintendo and The Pokémon Company channels.
The affected services are run by The Pokémon Company and support platforms including mobile devices and, in the case of Pokémon HOME, Nintendo Switch integration.
Security agencies worldwide disclosed two serious vulnerabilities in PHP, the widely used web scripting language.
PHP powers a large portion of the internet—widely cited industry figures place its usage at roughly 70% of websites—and the reported flaws trace back to PHP 5-era code introduced in 2004.
The vulnerabilities could allow remote command execution on poorly patched servers, a high-severity outcome that prompted urgent remediation guidance.
Multiple public-sector organizations were reported to have temporarily taken pages offline while fixes were applied.
According to the BBC, some organizations—including the Finnish government, Edinburgh City Council, and the BBC itself—pulled affected pages offline as a precaution.
Cybersecurity agencies recommended that organizations unable to apply immediate patches consider taking public-facing systems offline until updates could be deployed.
Media outlets covering the outage reported that Pokémon services showed maintenance messages.
Kotaku noted that accessing Pokémon HOME returned a persistent Japanese maintenance notice the site translated as: “We are currently under maintenance.
Please wait a moment until maintenance is finished.” Pokémon Champions initially launched but then displayed a message indicating “Emergency maintenance is currently ongoing.” Neither app provided an estimated restoration time at the time of reporting.
Pokémon Sleep was also reported unavailable.
Patches addressing the PHP flaws have been published, and sources including the BBC reported that an update was released to mitigate the issue.
However, remediation requires system administrators to apply those patches across affected servers and infrastructure; until updates are widely installed, exposed services can remain vulnerable.
For players and developers, the immediate facts are clear: The Pokémon Company temporarily took affected services offline in response to a validated, high-severity PHP vulnerability, third-party reporting confirmed maintenance messages on multiple apps, and security patches have been issued.
Stakeholders should monitor official channels—The Pokémon Company notices, the Nintendo eShop/ Nintendo Switch service pages, and reputable news outlets like the BBC—for restoration updates and follow guidance from their IT teams if they manage web infrastructure.
We will update this story as official statements and restoration timelines become available.
For more Nintendo coverage and service-status updates, check official Nintendo and The Pokémon Company channels.
