GOG took its store and its GOG Galaxy launcher offline on October 21 for "a couple of hours" of maintenance, the same day critical vulnerabilities in PHP became public and other sites began pulling themselves offline.
The company announced the downtime at 8 am Pacific and apologized for the inconvenience. It did not give a cause, and its announcement does not mention PHP. The connection rests on timing and circumstance, not on a confirmation from GOG.
PHP is a scripting language that runs on web servers and builds pages for a large share of the web. When a critical flaw surfaces in something that common, a standard short-term response is to take exposed systems down, apply the fix, and bring them back. A number of major sites and services went offline as a precaution while they patched, and security teams were described as scrambling to protect their properties.
Two other cases surfaced the same day. The government of Finland took down websites as a precaution. Players also reported that Final Fantasy 14 login servers were down. That second item comes from player reports, not a company statement, and no cause has been attached to it.
Pulling a storefront and a launcher offline, even briefly, carries a visible cost in lost sales and annoyed customers. That GOG accepted it suggests its engineers judged staying up to be the riskier option, though that is an inference, not something the company said.
The pattern recalls Log4Shell in December 2021, when a flaw in a widely used Java logging library sent companies everywhere racing to patch. The open questions are how many of the day's outages trace back to PHP at all, and what the flaws actually let attackers do. GOG's status update when it returns would settle the first question for its own site.