Key facts
- The outage blocked most desktop players while console users and characters already logged in remained online, leaving housing wards nearly empty.
- Square Enix took Final Fantasy 14's PC login servers offline on October 21 after PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 forced emergency security action.
- Locked-out players submitted their ward and plot numbers on a Reddit thread titled PHP Watering Service so volunteers could find their gardens.
- Console players and already-logged-in AFK players roamed empty residential wards to water strangers' crops without requesting payment.
Final Fantasy 14 players spent Oct. 21, 2026, and Oct. 22, 2026, watering locked-out strangers’ crops in residential wards while most desktop players remained locked out of the game.
On Oct. 21, 2026, Square Enix pulled Final Fantasy 14’s PC login servers offline because PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 required emergency security action. Players on consoles and characters already in the game remained online, while desktop users were barred from housing wards.
Final Fantasy 14 housing relies on an open-neighborhood ward system with limited physical plots in Mist, Shirogane, The Goblet, and Lavender Beds, distributed through competitive lotteries. Exterior estate plots come with deluxe garden patches for cross-pollinating rare botanical specimens. Growers create parent seeds by cross-pollinating Krakka Roots, Curiel Roots, Broombush, and Almonds. The resulting seeds require 120 continuous hours in Grade 3 Thanalan Topsoil.
Plants need water at least once every 24 hours, or they develop purple miasma and rot after another day of neglect. Thousands of homeowners could not reach their plots on Oct. 21, 2026, while their gardens continued to deteriorate. Residential agriculture does not pause during server interruptions, so untended crops keep decaying.
Players who could not log in shared ward and plot details on a Reddit thread named PHP Watering Service, so volunteers could find gardens. The volunteer effort reached data centers Aether, Primal, and Crystal, with priority on The Goblet, Lavender Beds, Mist, Shirogane, and Empyreum. Hundreds of unnamed adventurers ran through empty wards carrying watering cans.
Players organized an ad-hoc brigade that watered wilting onions and preserved millions of gil in garden labor across residential districts. Console players on dedicated PlayStation ecosystems and AFK characters already logged in were the only ones who avoided the Oct. 21, 2026, lockout, so they roamed empty wards to water strangers’ crops without requesting payment.
Square Enix turned off the automatic housing demolition timer on every server as a precaution while logins were down. The publisher said it expected logins to return on Oct. 22, 2026, about 18 hours after the shutdown began. It also said it worked continuously to test patches and reopen login access after roughly 18 hours offline.
Patch 7.57 required a full day of server maintenance on Oct. 12, 2026, and a separate hotfix window followed on Oct. 20, 2026. Square Enix had warned players about account breaches in the days leading up to the outage.
The flaws scored 9.2 out of 10 on the CVSS scale and could allow an attacker to steal data or take over a server. The PHP issue forced emergency maintenance for many online games and services, including Umamusume: Pretty Derby, Pokemon Champions, Pokemon Home, Pokemon Sleep, Steam, and Nintendo Switch Online. As of the Oct. 21, 2026, report, Nintendo Switch Online was still down on both Switch 2 and the original Switch. DeviantArt and Wikipedia also went offline for security maintenance, with DeviantArt returning at about 12:14 PM Eastern.





Join the discussion