A store goes dark
A DRM-free game store went dark on Wednesday, took its launcher down with it, and didn’t say why.
GOG announced at 8am Pacific on October 21 (15:00 UTC, 17:00 in South Africa) that its site and GOG Galaxy would be offline for maintenance. “We’re temporarily taking GOG offline for maintenance for a couple of hours,” the company posted on X. “GOG GALAXY will also be offline during this time. We apologize for the inconvenience and appreciate your patience!” As PC Gamer pointed out, GOG didn’t give a cause. Its holding page at gog.com says only that the store “is temporarily down for maintenance work” and that “Galaxy Launcher will also be down”, and it was still up when we looked at 18:45 South African time, close to two hours after the notice.
The timing is hard to ignore. On October 20 the PHP project warned that a security release was scheduled for 14:00 UTC on October 21, fixing two vulnerabilities both rated CVSS v4.0 9.2. Its advisory says PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35 “fix two critical vulnerabilities that can allow unauthenticated remote code execution,” and adds: “All PHP users are strongly encouraged to update immediately.” It names all PHP installations serving web requests as at risk.
Attacks were reported hours before the fix shipped
Security firm Patchstack’s timeline says details leaked on October 20, ahead of the coordinated disclosure, and that hosting partners reported multiple active exploitation incidents to it at 07:34 UTC on October 21. It logs the fixed PHP versions at 13:52 UTC, more than six hours later. Shortly after that, at 13:57 UTC, Patchstack said its telemetry showed “only probing attacks, with no hard evidence of breaches yet.”
Other operators were explicit about why they stepped back. PC Gamer reported that Finland’s government took websites down as a precaution, and Patchstack lists Dutch government services DigiD and MijnOverheid among the sites that went offline until the patch was out.
A store that sells ownership should say what it’s fixing
If this was GOG getting ahead of the PHP flaws, we don’t fault it for pulling the plug. A few hours offline beats leaving a storefront exposed on a day when exploit details were already out. But “maintenance” is a thin word from a store whose whole pitch is that the games you buy are yours. This month has already shown how fragile that promise can be: Legacy Games is closing its “yours to keep forever” store, and February 28, 2027 is the last day its buyers can download what they paid for.
Ownership has reached Washington too, where a congressman wants game purchases to mean ownership. Against that backdrop, “we’re applying an urgent security update” would cost GOG one sentence and tell customers exactly where they stand. We’d like to see GOG write it when the store comes back.
Sources checked October 21, 2026: GOG’s post on X and its maintenance page, the PHP project’s security advisory and release notices, PC Gamer’s report, and Patchstack’s incident timeline.
