If you opened the CASIO WATCHES app this week and got a maintenance screen where your watch controls should be, your watch is fine. Casio turned those screens off itself, and it hasn't turned them back on yet.
The suspension started on October 21, Japan Standard Time. Casio published the notice a day later and updated it again today, October 29. Eight days in, some of the app is still dark.
The cause is not a Casio bug in the usual sense. It's a critical security flaw in PHP, the programming language that runs a huge share of the web, and part of the CASIO WATCHES service is built on it.
What Casio has actually said
Casio's notice is short and careful, and it's worth reading exactly as written:
- A critical security issue was found in PHP, which Casio describes as a language used across web services worldwide.
- Parts of the CASIO WATCHES service use PHP, so Casio suspended "the affected functions/services" as a precautionary measure to protect customer information.
- As of the notice, Casio has not confirmed any unauthorized access to CASIO WATCHES or any information leak.
- There is no restoration date. Casio says it's working to restore service as quickly as possible.
Today's update adds the important practical detail. On some screens inside the app, a maintenance page now shows up in place of the normal watch operation screen. Pairing and connecting to the watch still work, and so does changing watch settings.
Casio also points owners at a workaround: if you need pairing instructions, use the PDF version of the manual from Casio's manual search rather than the "Instruction Manual" button inside the app, because that button is one of the screens behind the maintenance page.
What Casio has not said is which functions are affected and which watches are hit hardest. Independent coverage of the notice made the same point: the notice doesn't say that all connected features are down, so the practical impact varies by model and by what you actually use the app for.
The flaw behind the outage
Two vulnerabilities are behind this, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed php2shell.
PHP's own security team published the advisory on October 21, the same day Casio's suspension began. The short version: both bugs allow unauthenticated remote code execution, meaning an attacker can run code on a server without logging in first. They affect essentially every way of serving PHP, including Apache with mod_php (which PHP considers the highest risk), PHP-FPM, php-cgi, FrankenPHP and LiteSpeed. Patched versions are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
CISA issued an alert the same day telling organizations to patch immediately. On October 26 it added both CVEs to its Known Exploited Vulnerabilities catalog, which means exploitation had been observed in the wild.
The line in CISA's guidance that matters for a story like Casio's: organizations that cannot update immediately should take PHP-based systems offline until they can be patched. That is, in effect, what Casio did, at least for the parts of the app that touch PHP.
Restoring service is not just a case of applying a patch and flipping a switch. PHP issued a follow-up advisory on October 23 telling administrators to disable session upload progress until the next bugfix release, as an extra mitigation against one of the two bugs. A company running a consumer service has to patch, verify the patched version, check that its configuration isn't in the risky state, and then confirm nothing broke on the way back up. Casio is doing that with the app that tens of thousands of G-Shock owners use to set their watches.
Which watches this touches
CASIO WATCHES is Casio's official Bluetooth app, and it covers a lot more than one product line. Casio's own listing puts G-SHOCK, BABY-G, EDIFICE, PRO TREK, CASIO and OCEANUS under it, with major compatible models including the DW-H5600, GBD-H2000, GPR-H1000, GA-B2100, GBD-200 and GMW-B5000.
That list is worth reading closely if you're a runner or hiker, because the GPR-H1000 is the Rangeman with GPS, and the GBD-H2000 is the G-Shock Move with GPS and heart rate. Those are the Casio watches that compete for the wrist space this site usually covers, and they're the ones with the most to lose when the phone side goes quiet.
Casio's own G-Shock guidance says every Bluetooth G-Shock released from May 2022 onward uses the CASIO WATCHES app, so if you bought a connected G-Shock in the last few years, this is your app.
Why a server bug hits a watch
This is the part that should stick with you. A G-Shock is a watch first, and most of what it does happens in the case, on your wrist, with no network involved. Timekeeping, alarms, the stopwatch, the sensors: all local.
But a growing share of the experience sits on Casio's servers. Time sync from your phone, the watch settings menus, the activity data you pull off the watch afterwards, and the app's watch information pages all run through services Casio hosts. When one of those services has to come down for a security reason, your watch doesn't stop telling time, but the phone side of the experience does.
We've seen this movie before with the big Garmin outage in January 2025, when devices got stuck in a boot loop during GPS activities. Different cause, same lesson. The hardware is durable; the software layer above it is a service, and services go down.
The upside of the current situation is that Casio moved early. Suspending a service the day a critical flaw lands is the conservative call, and Casio says it has no evidence anything was breached. The cost of that caution is the maintenance screen you're looking at.
What to do right now
- Don't reinstall the app. This is server side. Clearing your cache or reinstalling won't bring the screens back.
- Keep pairing normally. Casio says pairing, connection and watch settings all still work.
- Use the PDF manual from Casio's manual search if you need pairing steps, instead of the in-app Instruction Manual button.
- Check Casio's support notice for the date stamp before you assume it's fixed. The October 29 update is the current state of play.
- If you were planning to buy a connected Casio, the GPR-H1000 and GBD-H2000 are unaffected as watches. The app features you'd use to set them up are the part in flux.
Bottom line
Casio did the responsible thing on October 21 and took the PHP-dependent half of its watch app offline the same day the flaw became public. Eight days later it's still partly down, which tells you how much work sits behind a "maintenance" screen: patching, reconfiguring, verifying, and then trusting the result with customer data.
The watch on your wrist will keep time through all of it. The app will come back when Casio is confident the backend is clean, and until then the maintenance page is the honest answer rather than a broken one.
If you want a broader look at how much of a modern watch depends on the vendor's cloud, our breakdown of Garmin's new personal API keys is a useful contrast, and the Mudman GDG-B100 review covers what Casio is doing on the hardware side.
Sources: CASIO notice "Notice of Partial Service Suspension for the CASIO WATCHES Smartphone App" (dated October 22, 2026, updated October 29, 2026), the Japanese-language version of the same notice, PHP security advisory for CVE-2026-109618 and CVE-2026-109619 and the October 23 follow-up advisory, CISA alert "Critical Vulnerabilities in PHP Require Immediate Patching" (updated October 26, 2026), the CASIO WATCHES app listing (Apple App Store), Casio's G-Shock Bluetooth guidance, Notebookcheck and Lowyat.net coverage of the suspension.
