Pokemon Home, Champions, and Sleep taken offline after PHP security flaws

The Pokemon Company took Pokemon Home, Pokemon Champions, and Pokemon Sleep offline worldwide on Oct. 21, 2026, after the apps entered emergency maintenance.

Two critical vulnerabilities in PHP that permit remote code execution on web servers triggered the security response. Remote code execution allows attackers to run commands on a server without authorization. Miketendo64 says community reporting ties the outages to vulnerabilities disclosed on Oct. 20, 2026, and the response followed on Oct. 21, 2026. The vulnerabilities affect versions dating back to PHP 5, released in 2004, so exposed code has circulated for decades.

Nintendo Everything and Kotaku identify PHP 5 as the earliest affected version. Approximately 70 percent of websites worldwide use PHP.

International cybersecurity agencies encouraged organizations using PHP to take systems offline temporarily if they could not apply mitigations quickly enough. Nintendo Everything cites the agencies, and Kotaku quotes the UK’s National Cyber Security Centre making the same recommendation. The BBC, the Finnish government, and Edinburgh City Council temporarily took pages or websites offline because of the same issue. DeviantArt and Ars Technica also became inaccessible while preparing to apply updates.

Security patches for the PHP flaws are available, but administrators must install them on every affected system before administrators can consider servers safe. Third-party software companies must also update their own technology that uses PHP. Until administrators install those updates, affected servers remain exposed.

GoNintendo and PokeQuery state that the Pokemon Company took the apps offline as a precautionary security measure, while Nintendo Everything presents company involvement as a possibility. GoNintendo said none of the apps have been attacked and players have no reason to be concerned. GoNintendo characterizes the shutdowns as precautionary and promises the services will be perfectly secure when restored.

Official Pokemon notices do not explicitly name the PHP vulnerability, though the timing and security language align with the broader incident. Miketendo64 notes that official notices avoid naming the flaw even though the timing matches the security incident. The official Pokemon Japan website is also down for maintenance.

Players attempting to open Pokemon Home see a Japanese error message and remain stuck at the maintenance screen. Kotaku documented the Japanese error on a phone, and Nintendo Everything confirms the message does not clear. Pokemon Champions appears to start normally before showing a warning. Pokemon Sleep players cannot start new sleep tracking, and sessions begun earlier may not finish research correctly.

Miketendo64 says compensation for affected players is being considered and will be announced later.

Pokemon Home entered emergency maintenance earlier on Oct. 21, 2026. Pokemon Champions began around 11:00 UTC, and Pokemon Sleep started at 14:00 UTC according to the English official account or 23:00 according to the Japanese account. Miketendo64 provides staggered start times based on official Pokemon accounts. As one observer put it, “Multiple Pokémon games have been taken offline including Pokémon HOME, Champions, Sleep.”

Kotaku attributed the observation to Centro LEAKS (@CentroLeaks).

A separate, previously scheduled Pokemon Sleep version 3.9.0 maintenance remains planned for Oct. 22, 2026. The emergency security work is separate from that routine update maintenance. The routine update maintenance was already planned before the emergency security work began.

No restoration date or estimated return time has been announced for Pokemon Home, Pokemon Champions, or Pokemon Sleep. Kotaku and Nintendo Everything report that neither app indicates how long it will stay down. Miketendo64 confirms no service has published an end time. GoNintendo predicts the Pokemon apps and website will come back soon, while other outlets report that no service has published an end time.

Miketendo64 says the situation is fluid and expects official channels to publish completion notices after the security work ends. Trainers relying on Pokemon transfers, competitive play, or overnight sleep tracking should monitor official channels for completion notices.

The outage disrupts cloud storage and companion-app access worldwide. Cloud storage and companion-app access remain disrupted for the duration of the outage. Pokemon Home, Pokemon Champions, and Pokemon Sleep remain offline while administrators apply patches and third-party companies update their own PHP-based technology.