Japanese travel game World Quest shuts down same day over PHP vulnerability
In short
The operators of the travel game World Quest (ワールドクエスト) announced on 21 October that the service would end that day. They said a serious vulnerability in the PHP language used on its server could not be adequately addressed because the game runs on an old system. A second game, Boku no Makai o Sukutte! (僕の魔界を救って！), announced its closure on 22 October for a similar reason.
Read the full story 2 min read
The operators of the travel game World Quest (ワールドクエスト) announced on 21 October that the service would end that day. The announcement came through the game's official website and its official X account. The operators said they had learned of an announcement that a serious vulnerability had been found in PHP itself, the programming language used on the game's server. [ 1 , 2 , 3 ]
The operators explained that the game runs on an old system, so they could not take sufficient measures against the flaw. They said they put protecting users' information first. According to ITmedia, the notice on the official site apologised for the sudden announcement. ITmedia and 4Gamer.net said a greeting to users would be posted later, 4Gamer.net specifying that it would appear on the page announcing the closure. [ 1 , 2 , 3 ]
ITmedia reported that the PHP developers had just released, at about 11 pm on 21 October, versions fixing two vulnerabilities rated emergency level. It said the flaws could let someone run arbitrary code remotely without authentication. The fixed versions cover four lines from PHP 8.2 onward, and the developers urged users of older versions to move to supported versions. Livedoor News also said the developers published an update on the 21st and called on users to update promptly. [ 1 , 3 ]
ITmedia said the flaw had spread effects in Japan, with well-known services such as BASE and Kodomon (コドモン) going into emergency maintenance one after another. [ 1 ]
Livedoor News reported that another game, Boku no Makai o Sukutte! (僕の魔界を救って！), announced on 22 October that it would also close. Its operators said the PHP used on the game's server had a serious vulnerability, and that the server had run in an old environment since the service began more than ten years ago. They said migrating the operating system and PHP to a new environment was not realistic, and that they could not keep running while exposing players' information to danger. They added that they hoped to return to the game in some other form some day. [ 3 ]
According to ITmedia, World Quest let players visit 100 real countries and more than 1,000 cities. It was released in 2011 on GREE and later expanded to Mobage and Wakupura, and its service ended in May 2019. It was revived in May 2020, according to the official X profile, so that people unable to travel abroad during the coronavirus pandemic could enjoy overseas travel in the game. ITmedia said it had continued with almost no change in content since. [ 1 , 2 ]
Why it matters
Livedoor News reported that long-running online services were announcing closures one after another, as ageing server environments made safe countermeasures difficult. ITmedia said well-known services such as BASE and Kodomon (コドモン) also went into emergency maintenance.
Key facts
- World Quest's operators announced on 21 October that the service would end that day. [ 1 , 2 , 3 ]
- The operators said a serious vulnerability had been found in PHP, the programming language used on the game's server. [ 1 , 2 , 3 ]
- The operators said the game runs on an old system and cannot be adequately protected, and that they put protecting users' information first. [ 1 , 2 , 3 ]
- The PHP developers released versions fixing two vulnerabilities on 21 October; ITmedia said this was at about 11 pm. [ 1 , 3 ]
- ITmedia said the flaws could let someone run arbitrary code remotely without authentication. [ 1 ]
- The game Boku no Makai o Sukutte! announced its closure on 22 October, citing a PHP vulnerability and an old server environment. [ 3 ]
Confirmed by several sources
- World Quest's operators announced on 21 October that the service was ending that day because of a serious PHP vulnerability they could not adequately counter on an old system. [ 1 , 2 , 3 ]
- The PHP developers released an update on 21 October fixing two serious vulnerabilities that could allow remote code execution without authentication. [ 1 , 3 ]
- A greeting to World Quest users is to be posted later; ITmedia and 4Gamer reported this. [ 1 , 2 ]
Still unclear
- The time of day at which World Quest's operators made their announcement is not given. The documents give only the date, 21 October.
- Which other services may follow is not stated. Livedoor News said closures were following one another, but names only two games.
What local media are saying
Timeline, local time
- On 21 October, about this time, the PHP developers released versions fixing two vulnerabilities, according to ITmedia. [ 1 ]
- ITmedia published its report on 22 October. [ 1 ]
- 4Gamer.net published its report on 22 October. [ 2 ]
- Livedoor News published its report on 22 October, including the closure of a second game. [ 3 ]