Final Fantasy XIV players can log in again after Square Enix suspended new sessions worldwide to secure its patch servers against critical PHP vulnerabilities. The same security emergency forced maintenance across several Cygames titles, including Umamusume: Pretty Derby and Princess Connect! Re:Dive.
By 23 October 2026, FFXIV’s login access and server backup feature had returned. For players, the remaining developments concern housing deadlines, subscription compensation and the disruption of time-sensitive activities in other games.
FFXIV’s login restriction ended on 22 October
Square Enix temporarily took the game’s patch servers offline on 21 October while applying security measures. New logins became unavailable across all worlds. The announcement concerned entry into the game rather than a complete shutdown of every world already running.
Updated patch servers were deployed at approximately 5:16 a.m. PDT on 22 October, allowing new logins to resume. The separate server backup feature for save data remained unavailable longer, returning on 23 October after additional security work. Configuration data sharing was also restored.
The outage was unrelated to the upcoming Final Fantasy XIV: Evercold expansion, which GTR has covered separately.
FFXIV’s housing demolition timer restarts on 26 October
Square Enix also paused the automatic housing demolition timer during the emergency. It is scheduled to restart on 26 October at 1:00 a.m. PDT, several days after new logins were restored.
That separate date is important for homeowners. Players maintaining an estate should check their housing status when the timer resumes rather than assume it restarted as soon as the game became accessible again.
Eligible subscribers receive one extra day of game time
Square Enix has announced one additional day of game time for eligible accounts on the global service. The company specifies two requirements: the full game must be registered, and the account must have had an active subscription on 22 October 2026.
Distribution is scheduled to begin on 28 October and may take two to three days to finish. Compensation arrangements can differ between operating regions. The extension restores subscription time but does not automatically replace missed in-game activities.
Umamusume was offline for seven hours
The English-language service of Umamusume: Pretty Derby entered emergency maintenance at 1:00 p.m. UTC on 21 October and reopened at 8:00 p.m. UTC. Gameplay and account data linking were unavailable during that period.
Cygames told players that the maintenance would not erase in-progress Career data. After service resumed, it distributed 150 Carats to eligible trainers who had started playing before maintenance began.
The seven-hour interruption affected a game built around Career runs, training and daily activities. The English-language compensation should not be confused with the separate arrangements announced for the Japanese service.
Princess Connect warned about interrupted battles and rewards
Princess Connect! Re:Dive also announced emergency maintenance linked to PHP. Its Japanese service warned that battles interrupted by maintenance could be invalidated regardless of their outcome. Players could lose stamina or a challenge attempt without reimbursement, while certain unclaimed rewards could expire.
These were warnings about possible consequences, not confirmation that every player lost resources. They highlight the particular cost of unexpected downtime in games where battles, challenges and rewards operate on timers.
Granblue Fantasy and Shadowverse: Worlds Beyond also announced PHP-related security maintenance. Their maintenance periods and any compensation arrangements should be assessed separately rather than assumed to match Umamusume’s.
Why PHP security flaws affected online games
On 21 October, the PHP project disclosed two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619. Under vulnerable conditions, they could allow unauthenticated remote code execution. The project released security fixes for PHP 8.2, 8.3, 8.4 and 8.5.
PHP does not need to run an MMO’s combat engine or the game client itself to affect access. Online games rely on additional services for accounts, patch distribution and other web-facing functions. Securing one of those components can require disabling logins or taking related services offline.
The official gaming notices describe precautionary maintenance. They do not establish that these services were successfully attacked or that player information was stolen.
As of 23 October, FFXIV’s new logins and backup service are restored, and Umamusume’s English-language maintenance has ended. FFXIV homeowners still have the separately scheduled 26 October housing timer restart to watch, while eligible subscribers can expect their extra game time from 28 October onward.
Sources: Square Enix — FFXIV initial login suspension; Umamusume.gg — reprint of the English-language maintenance notice; PHP Group — October security releases.