Kathmandu, Kartik 13 - The Ministry of Health and Food Safety has directed all departments, hospitals, centers and offices under it to urgently upgrade vulnerable PHP and Node.js systems after critical cybersecurity flaws were identified. The ministry says the action is necessary to protect sensitive patient information and prevent unauthorized access to health-sector systems.
The directive follows cybersecurity advisories concerning two serious PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, as well as a Node.js vulnerability known as Node2Shell (CVE-2026-111497). If exploited, these weaknesses could allow attackers to gain unauthorized access, disrupt services or potentially take control of affected systems.
Health institutions have been told to identify affected servers, websites and applications, update them to secure software versions and test them before restoring services. Any internet-facing system that remains vulnerable must stay offline until it has been patched and verified as secure.
The ministry has also instructed institutions using third-party IT vendors to ensure that those vendors apply the necessary updates and provide written confirmation. Officials must monitor system logs, preserve digital evidence where suspicious activity is detected and immediately notify the National Cyber Security Center and the ministry if they suspect that a system has been exploited.
The issue is particularly important in the health sector because hospital and government systems can contain personal and medical information. Under the Privacy Act, 2075, individuals have a right to privacy over personal information and data stored electronically, and such information cannot be accessed or disclosed without authority.
Nepal’s Electronic Transactions Act, 2063 also criminalizes unauthorized access to computer programs, information or data. Under Section 45, such access can result in a fine of up to Rs200,000, imprisonment for up to three years, or both, depending on the seriousness of the offence.
All health institutions covered by the directive must now submit an implementation report to the ministry’s Information Technology and E-Health Section, even if they do not use PHP or Node.js systems.
The directive highlights that cybersecurity is not only about responding after information has been stolen. Institutions handling sensitive health data must also take preventive measures such as timely updates, secure software, system monitoring and proper vendor management before a breach occurs.
Source: Nepal News
