Kathmandu, Kartik 8 – Thousands of government and banking websites in Nepal have been temporarily taken offline after critical security vulnerabilities were discovered in PHP, a programming language widely used to operate websites and online services.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and collectively referred to as PHP2Shell, were disclosed by the PHP Foundation on October 21. Security patches were released after researchers found that vulnerable systems could potentially allow attackers to remotely execute malicious code and access sensitive information without first authenticating themselves.
In Nepal, the precautionary shutdown has affected websites operated by ministries, government departments, commissions and other public bodies. The official website and some web-based services of Nepal Rastra Bank were also temporarily suspended, while several banks and financial institutions took their websites or digital services offline while security updates were being installed.
The Vehicle Consignment Tracking System (VCTS) operated by the Department of Revenue Investigation was also suspended because of the security risk. During the shutdown, freight vehicles have been permitted to operate using the required bills and invoices, but users will have to complete the relevant VCTS records once the system resumes operation.
The National Cyber Security Centre has instructed organizations to update affected systems and strengthen security monitoring. Authorities stressed that the shutdowns were preventive and that, as of the report, there had been no confirmed case of unauthorized access or cyberattack in Nepal linked to the PHP2Shell vulnerabilities.
A major challenge is that some Nepali government systems continue to operate on older PHP versions that are no longer officially supported. Such versions may no longer receive regular security patches, meaning authorities may have to upgrade entire systems rather than simply install one security update. Officials are also conducting source-code audits of older government systems to identify other vulnerabilities that may have remained undetected.
The incident raises an important legal issue because government and financial websites may store or process citizens’ personal, financial and administrative information. Nepal’s Privacy Act, 2075 recognizes an individual’s right to privacy over personal information, correspondence and data held electronically, and prohibits unauthorized access to or disclosure of such information.
Nepal’s Electronic Transactions Act, 2063 also criminalizes unauthorized access to computer systems. Under Section 45, accessing computer programs, information or data without proper authority can result in imprisonment of up to three years, a fine of up to Rs200,000, or both. Section 46 similarly criminalizes intentionally damaging, deleting, altering or otherwise interfering with information stored in computer systems.
However, cybersecurity is not limited to punishing hackers after an attack occurs. The PHP2Shell incident also highlights the importance of regular security updates, supported software, source-code auditing, maintenance contracts and proper protection of public digital infrastructure.
Taking a vulnerable service temporarily offline may inconvenience users, but where a serious security flaw could expose sensitive government or banking information, preventing unauthorized access before an attack occurs can be safer than continuing to operate an insecure system.
Authorities say affected services will be restored gradually after security patches, system upgrades and testing are completed.
Source: The Kathmandu Post
