In short: From the evening of October 21, 2026, many Japanese websites and apps — online shops, e-book stores, video and game services — went into “emergency maintenance”. They were installing a critical security fix for PHP, the programming language that runs many websites, released at 11 pm Japan time. If a service is down, check its official notice for the end time, and look at your order history before you try again.
This article covers what we could confirm from news reports and the official PHP website (checked October 21, 2026).
Which services paused
According to GIGAZINE (October 21, 10:13 pm JST), these services announced maintenance. Times may change.
- BASE (online shop platform): from 3:50 pm on October 21, planned to end at 7 am on October 22
- Melonbooks (books and goods): from about 5:30 pm on October 21 to about 10 am on October 22
- BOOK☆WALKER (e-books): store paused until early morning on October 22
- pixiv: until the small hours of October 22
- Niconico: from 7 pm on October 21, end time not set
- Bandai Channel: from 8 pm on October 21, end time not set
- Animate’s online store and the games Pokémon Sleep (from 11 pm), Umamusume (from about 10 pm) and Granblue Fantasy (from 10 pm) were also reported to be under maintenance
Why so many at once
The PHP team announced on October 20 that it would release fixes for two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619, rated CVSS 9.2 in the announcement). The fixes came out on October 21 at 14:00 UTC (11 pm in Japan). The flaws could let an attacker who is not logged in run code on a web server, so many companies paused their services to install the fix. Japan’s IPA (Information-technology Promotion Agency) said on October 21 that it had not yet seen the flaws being exploited.
What to do if a service you use is down
- Check the official notice. Look at the service’s own website or official social media account for the end time. It can be extended.
- Check your order history first. If maintenance started while you were paying, your order may have gone through. Check your order history and confirmation email before ordering again, so you don’t order twice.
- Don’t click links in emails or texts about “logging in again”. Scammers often use news events. Open the official app or your usual bookmark instead.
- Wait for the company’s notice about deadlines. If you missed a sale, coupon or booking deadline, each service decides how to handle it. Check their notice after they reopen.
If you run a website
If your site runs on PHP (WordPress, for example), make sure PHP is updated to at least one of these versions: 8.5.12, 8.4.27, 8.3.36 or 8.2.35, depending on the branch you use. PHP 8.1 and older no longer get regular updates from the PHP project. In WordPress you can see your version under Tools → Site Health → Info → Server → PHP version. On rental (shared) hosting, updating PHP itself is usually the hosting company’s job, so check their notices. The PHP team says the only complete fix is to update; setting changes are not a full workaround.
