Pokémon HOME, Pokémon Champions, and Pokémon Sleep were all taken offline yesterday amidst the PHP cyber attacks that have affected huge swathes of websites.
PHP programming language is used on a huge range of websites and apps, and was yesterday found to contain two critical vulnerabilities that could be exploited. As per the National Cyber Security Centre:
“PHP has published a security update to address a critical security issue that may allow attackers to execute commands on any web server running PHP.
PHP (PHP Hypertext Preprocessor) is a widely used server-side scripting language designed for web development. It runs on a web server to generate dynamic page content, interact with databases, and handle backend application logic before delivering the final HTML output to a user’s browser. PHP is also used in a range of other products.
The security issue could allow an attacker to trigger an out-of-memory (OOM) condition in PHP that results in memory corruption. Under certain conditions, this corruption could be exploited to achieve unauthenticated remote code execution. This security issue has now been fixed.
- CVE-2026-109618: Out-of-memory handling can interrupt PHP while internal request data is only partially initialized. Request cleanup may then treat the invalid data as valid.
- CVE-2026-109619: Request-owned internal state can survive after its backing memory has been freed. A later request handled by the same worker may use that stale state before normal initialization resets it.”
Websites as wide ranging as government websites, the BBC, local council websites, WordPress, and more, and many apps, were taken offline while the patches and updates were implemented. It has been estimated that approximately 70% of the internet was potentially impacted by this issue.
For Pokémon fans, this meant a long and unexpected period of downtime in Pokémon HOME, Pokémon Champions, and Pokémon Sleep. At the time of writing Pokémon Sleep is still in maintenance mode, as it was due for routine maintenance on 22nd October 5am to 10am UTC, and the security fixes were not available before this planned maintenance was due to occur. Pokémon Champions is now back up and running, and Pokémon HOME is back online as of 12:30am Pacific Time today.
Many players of these games are hoping to receive some sort of compensation for this unplanned downtime. Pokémon Sleep researchers may be using premium items such as Good Camp Tickets or Expert Tickets, that they have now lost 18 hours+ of usage for. Pokémon Champions has not announced any compensation on their social media channels at present.
Pokémon GO was not impacted by this security issue, and it is believed this is because it is not part of the ILCA Inc. branch of Pokémon projects which is responsible for HOME and Sleep engineering, as well as creating Pokémon Champions alongside Pokémon Works.
