Capcom pulls Street Fighter V from sale and keeps its servers offline over a PHP security flaw

Street Fighter V is off the shelves for now. In an October 27 notice, Capcom said that “to further strengthen security related to the PHP programming language used in the PlayStation 4 and Steam versions of Street Fighter V, content requiring online functionality is currently unavailable.” Emergency maintenance is underway, and until the fix is finished, sales on the PlayStation Store and Steam will be suspended in stages, according to Capcom’s support notice. Capcom’s own Capcom Town Store has paused sales of the Steam version too.

What still works. Offline content is still playable, and players who already own the game can keep playing it offline, Capcom says. Output Lag lists Story, Arcade, Survival, Training and local versus as still running, while ranked and casual matches, the Battle Lounge, Fighter Profiles and the in-game shop are down. The outlet also reports that the game’s Steam page has already lost its buy button.

This has been building for a week. Capcom first flagged emergency maintenance tied to PHP security last week, on the Street Fighter account on X and then on Steam, VGC reports. The trigger is PHP’s October 21 security release, which fixed two critical flaws that the PHP team says can allow unauthenticated remote code execution, according to Output Lag. Capcom hasn’t said whether anyone exploited the flaws against its servers, only that it’s strengthening security.

No return date yet. Capcom hasn’t given a timeline for Street Fighter V’s online features or store listings to come back, per VGC and Shacknews.

PPR take: A 2016 fighting game getting yanked over a web-language bug is a good reminder of how much older online games lean on backend code nobody’s touched in years. If you still play SFV online, the offline modes are all you’ve got until Capcom posts an update.