Pokémon Home, Sleep, and Champions Go Offline Amid Critical PHP Security Vulnerabilities

If you are trying to log into your Pokémon apps today and are getting met with maintenance screens, you aren’t the only one. Multiple titles, including Pokémon Home, Pokémon Sleep, and Pokémon Champions, have been taken offline following the discovery of two major security vulnerabilities within the PHP programming language. According to reporting from Kotaku, the decision to pull these services comes as a proactive measure to protect against potential cyberattacks while necessary patches are implemented.

The scope of the exploit

The issues stem from serious vulnerabilities affecting versions of PHP dating back to 2004. Because PHP powers a massive portion of the internet—estimated at up to 70 percent—the potential for exploitation is significant. The flaw allows unauthorized individuals to execute remote commands on affected web servers, effectively letting them run malware or perform tasks as if they had administrative control. Cybersecurity agencies worldwide have advised organizations to take vulnerable systems offline until the patches can be fully applied. The Pokémon Company has followed this guidance, resulting in the current downtime for their suite of connected apps.

Current status of Pokémon apps

Players attempting to access these services are currently seeing various error messages. Users of Pokémon Home are reporting a maintenance notification, while Pokémon Champions is displaying an “Emergency maintenance” warning. As noted by the account Centro LEAKS on X (formerly Twitter), the downtime is a direct response to the critical PHP exploit. At this time, there is no official timeline for when these services will return to normal operation, as the process requires security updates to be applied across all server levels.

Why it matters

For players, this means your access to cloud storage, battle simulators, and tracking features is currently on hold. While it is frustrating to be locked out of your games and tools, this downtime is a standard security precaution. Because the vulnerability allows for remote code execution, The Pokémon Company is likely keeping the services offline to ensure that user data and server integrity are not compromised while they apply the necessary server-side fixes.

Keep an eye on official social channels for updates on when maintenance will conclude. If you have active subscriptions or time-sensitive events within these apps, expect potential disruptions until the developers confirm that their infrastructure is fully secured.