Nepal shuts some government websites over critical PHP flaw
Nepal has temporarily shut down some government websites and digital systems as a precaution after a serious weakness was identified in PHP, a technology widely used to run web services. The action was described as a measure to reduce the risk of a potential cyberattack, rather than as evidence that an attack had succeeded.
The Software Development and Operation Center, which sits under the Office of the Prime Minister and Council of Ministers, issued its security advisory on Thursday 22 October. It identified two vulnerabilities known collectively as PHP2Shell and said technical teams were working to address the risk during the Dashain holidays.
What prompted the shutdown
The two flaws are tracked as CVE-2026-109618 and CVE-2026-109619. A United States federal cyber-security agency said they allow unauthenticated remote-code execution in PHP installations that serve web requests. In practical terms, that means a person could potentially run code on a vulnerable server without first having a valid user account.
The same agency said all PHP installations serving web requests are affected and urged organisations to patch immediately, with internet-facing systems treated as a priority. It listed updated releases for supported PHP versions and said systems that could not be updated straight away should be taken offline until they could be patched or upgraded.
Nepal’s temporary shutdown reflects that risk-management advice, but it is a distinct operational response by the country’s public digital-services teams. The centre said affected systems would be restored in stages after security patches had been applied and after testing and verification had been completed.
No confirmed compromise in Nepal
Available information does not show that any Nepalese government system was exploited, that data was accessed or that a particular website was compromised. The report of the shutdown did not identify the websites or systems involved, how many were taken offline, or whether any user information was at risk.
That distinction matters. Taking systems offline can be a preventive step while administrators establish which services use affected software, install fixes and check that an updated system is safe to return to service. It should not be read as confirmation of a successful intrusion or of an impact on individual users.
On 23 October, the United States agency said it had not observed exploitation of the vulnerabilities at the time of its alert. That was a general assessment of the flaws, not a finding about Nepal, and it cannot establish the status of every individual system.
Restoration will be phased
The centre has not announced a timetable for the restoration of each affected website or digital system. Its stated sequence is patching, testing and verification, followed by a phased return. That means systems need not all become available at the same time.
The approach also leaves several practical details unconfirmed, including which public functions were interrupted and whether alternative routes were provided for people seeking those services. No claim should be made that all government websites were shut down: the stated action concerned some websites and systems.
For now, the documented development is a targeted precaution while a critical software weakness is addressed. The scale of the interruption, the final list of affected systems and the outcome of the technical checks have not been made public in the available information.
