Street Fighter V is being pulled from sale and its online modes are switched off, and the reason is a server bug that has nothing to do with fighting games. Capcom posted a notice on the Street Fighter account early on October 27 saying that “to further strengthen security related to the PHP programming language used in the PlayStation 4 and Steam versions of Street Fighter V, content requiring online functionality is currently unavailable.” Emergency maintenance is underway, and until the fix is complete, “sales on the PlayStation Store and Steam will be suspended in stages.” Offline content still works.
The Steam listing has already lost its price. The store page for Street Fighter V still loads, but the buy button is gone, and the game’s Steam news feed has carried an emergency maintenance notice since October 23 with the same PHP wording. Capcom has not given a date for the fix or for sales to resume.
The PHP flaw is a week old and lets attackers run code without logging in
The bug behind the shutdown is public. On October 21 the PHP project released PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two critical vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which the security team says “can allow unauthenticated remote code execution.” Any PHP installation serving web requests is at risk. The team rates the danger highest for Apache’s mod_php, where it has “a demonstrated exploit where an unauthenticated request can trigger the attack before any application code runs.” Unusually, the project also published minimal source backports for PHP 7.4, 8.0 and 8.1, versions it stopped supporting years ago, because so many older servers still run them.
Capcom’s notice says Street Fighter V’s online services use PHP, which puts the game’s matchmaking, Fighter Profiles and shop backend in the category the advisory describes. Capcom has not said whether anyone exploited the flaw against its servers, only that it is strengthening security. Its notice is a precaution as written, not a breach disclosure.
Sales stop on Steam and the PlayStation Store, offline modes stay playable
Street Fighter V launched on February 15, 2016 on PS4 and PC, grew into the Arcade and Champion Editions, and got its last fighter, Luke, on November 29, 2021. Street Fighter 6 replaced it in June 2023, but the older game kept its servers running for players who never moved over. Those are the modes that are off now: ranked and casual matches, the Battle Lounge, Fighter Profiles, and the in-game shop. Story mode, Arcade, Survival, Training and local versus still run, and anyone who already owns the game keeps it.
The phrase “suspended in stages” matters for anyone thinking about buying it. The Steam listing is already closed to new purchases, and the PlayStation Store version is expected to follow. Capcom frames both as temporary, but it has a precedent that gives fans pause: Street Fighter X Tekken was “temporarily” removed from sale on Steam in 2021 over a Games for Windows Live issue, and five years later it is still not purchasable, while its DLC pack remains on sale.
Any game with a PHP backend has the same homework this week
Street Fighter V is the first game to go dark over this advisory by name, but it will not be the only service affected. PHP sits behind a large share of login, leaderboard and store backends for older titles, and the advisory’s own mitigations, such as removing the PHP memory limit and capping upload sizes, are stopgaps that the security team says “do not make an installation safe.” The only complete fix is the update itself, which for a decade-old game can mean touching code nobody has shipped against in years. That is the work Capcom says it is doing now, and the delisting is the price of doing it carefully.
“[Notice] To further strengthen security related to the PHP programming language used in the PlayStation 4 and Steam versions of Street Fighter V, content requiring online functionality is currently unavailable. Offline content remains available and can still be enjoyed. Emergency maintenance is currently underway to address this issue. Until the fix has been completed, sales on the PlayStation Store and Steam will be suspended in stages. We sincerely apologize for the inconvenience this has caused and appreciate your patience and understanding.”
