Capcom Suspends Street Fighter V Sales and Online Play Over PHP Flaws

Video game publisher Capcom announced on October 27, 2026, that it is taking online services offline and suspending digital sales for Street Fighter V across PlayStation 4 and Steam. The emergency measures were enacted to reinforce security surrounding the PHP programming language, which underpins the 2016 fighting title's online features and web architecture.

Digital storefronts have already begun reflecting the decision. On Steam, the game's purchase options were removed, replaced by a notice indicating that the title is no longer available on the platform's storefront. Capcom stated that sales on both the PlayStation Store and Steam would be paused in stages until engineering teams complete the required fixes. Meanwhile, the game's official Capcom Fighters Network portal, CAPCOM:Shadaloo C.R.I., displayed a maintenance notice.

Online components—including casual and ranked matchmaking, Battle Lounges, Fighter Profiles, and the in-game shop—have been disabled while emergency maintenance proceeds. Existing owners retain access to the game and can still play offline modes, such as Arcade, Story, Survival, Training, and local versus matches. Capcom apologized for the disruption on its official social media channels, asking for player patience as the technical team works through the updates.

The emergency maintenance follows critical security developments within the open-source PHP project. On October 21, 2026, PHP developers issued patched releases—versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35—to address two vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities carry a 9.2 severity rating on the CVSS v4.0 scale and can allow unauthenticated remote code execution. The security team noted that server configurations handling web requests were at risk, with the highest threat directed at Apache installations running mod_php.

Capcom first flagged security work on the title in a Steam emergency maintenance notice published on October 23, 2026. The publisher's public messaging frames the shutdown as a preventative security hardening effort rather than a response to a confirmed data breach. Capcom has not disclosed whether its servers suffered unauthorized intrusion or whether any player data was compromised, nor has it provided a definitive target date for when online infrastructure and store listings will be restored.

Street Fighter V originally launched in February 2016, and although Capcom moved its flagship competitive focus to Street Fighter 6 upon its release in June 2023, the older title maintained an active backend for its community. Older game servers frequently rely on legacy software stacks that can be complicated to update. PHP maintainers even provided minimal source code backports for older, unsupported branches such as PHP 7.4, 8.0, and 8.1, highlighting how many legacy deployments worldwide remain exposed to the underlying bugs.

The unexpected halt on sales has raised concern among fighting game players, some of whom referenced Capcom's handling of past titles. In 2021, the company temporarily pulled Street Fighter X Tekken from Steam due to issues linked to Games for Windows Live; five years later, the title remains delisted from sale despite its downloadable content pack remaining available for purchase. While Capcom maintains that the suspension of Street Fighter V sales is temporary, players are watching closely to see how long remediation of the PHP backend will take.