Steam users are reporting widespread issues with the gaming platform today (October 21), with more than 1,000 reports logged on DownDetector. The majority of problems, 70%, are related to server connection, while 12% involve login difficulties and 10% concern purchases. Issues began appearing shortly after 3pm this afternoon.
User Reports and Social Media Reactions
Several Steam users have taken to social media to share their experiences. One user, Jigyanshu (@iamjigyanshu), posted: "Is Steam store down or what?" Another added: "Steam is reportedly down for some gamers right now." A third user described the issue in more technical terms: "Seems like the store is down, every page gives error E502 L2. Does this have to do with the PHP vulnerabilities that were found and (many) sites are waiting on a patch for?"
The timing of the outages coincides with a security alert from the National Cyber Security Centre (NCSC), which issued a warning today encouraging UK organisations to take immediate action to mitigate security issues affecting PHP (CVE-2026-109618 and CVE-2026-109619). PHP is a general-purpose scripting language geared towards web development, used across many websites.
NCSC Issues Urgent PHP Warning
The NCSC has updated its PHP alert to reflect the release of mitigations, urging UK organisations to act promptly. A spokesperson for the NCSC stated: "Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated." Cyber-security agencies in the EU and Australia have issued similar warnings.
PHP is used on servers to generate website content and can be found running beneath public websites, content management systems, and hosting platforms. Don Smith, from the Sophos Counter Threat Unit, told the BBC: "The use of PHP is pervasive, it can sit beneath public websites, content management systems, hosting platforms and third-party products, sometimes without even being obvious to the organisation using it."
Vulnerabilities and Potential Impact
The European Union Computer Emergency Response Team (CERT-EU) said the vulnerabilities could allow unauthenticated remote code execution, potentially enabling attackers to install malware or disable websites. CERT-EU also warned that the flaws could affect all PHP versions dating back to PHP 5, released in 2004. A fix is due to be issued this afternoon (Wednesday, October 21).
Understanding DownDetector
DownDetector is an online platform that allows users of popular services, including X, Instagram, Facebook, and Virgin Media, to report service disruptions. The site only reports an incident when the number of problem reports is significantly higher than the typical volume for that time of day. Describing itself on its website, DownDetector is "where people go when services don’t work."
The website monitors disruptions to various key services, including the internet, web hosting platforms, banks, and social media. Users can submit issue reports, and problem indicators are also collected from social media and other web sources. These reports are validated and analysed in real-time, with an incident detected if the number of reports is significantly higher than the average for that service. Users investigating issues can see the most reported problems and check if their area is in an outage hotspot.
