Capcom has delisted Street Fighter 5 from the PlayStation Store and Steam and shut down the 2016 fighting game's online functionality, citing the need "to further strengthen security related to the PHP programming language used in the PlayStation 4 and Steam versions."

The company announced the move on the official Street Fighter account, saying emergency maintenance is underway and that sales will be suspended "in stages" until the fix is complete.

Offline content remains fully playable for existing owners, so the single-player modes and local versus play are unaffected. Capcom has offered no timeline for when online features return or when the game relists on storefronts.

It is rare for a security fix in a server-side scripting language to escalate all the way to pulling a decade-old game off sale.

The niche detail working programmers will savor: the PS4 and Steam builds of Street Fighter V apparently ship PHP in a form exposed to the vulnerability, making the game itself an unexpected casualty of a web-language flaw.

The root cause traces to late last week, when, according to Video Games Chronicle, a group of cybersecurity researchers and organizations used AI to discover two major vulnerabilities in the PHP programming language, which has underpinned web development for decades.

The findings triggered emergency patching across the web and took a number of sites and services down temporarily.

Shacknews reports the issues caused widespread concern, especially for systems running older PHP versions that have not seen updates — and that older systems such as 2016's Street Fighter 5 are at risk from those vulnerabilities.

VGC notes Capcom posted its first notice on X last Wednesday, followed by a Steam-page statement on Friday, before this week's delisting.

For players, the immediate stakes are practical: anyone who already owns Street Fighter 5 can keep playing offline, but online matches and purchases are frozen indefinitely, and Capcom has given no estimated return date for either.

For developers, the episode is a pointed reminder that legacy software with embedded PHP stacks inherits every upstream language vulnerability unless someone maintains those components — a ten-year-old game can be delisted by a bug disclosed in a scripting language.

Shacknews suggests staying tuned to the broader PHP topic for further news, and Capcom says it will restore online functionality and storefront sales once the fix is complete.