Banks, financial institutions, the Employees Provident Fund, the Social Security Fund and other government agencies have taken their websites offline as a precaution after serious security flaws were discovered in PHP, a widely used programming language.

The shutdowns are intended to reduce the risk of cyberattacks. Banks and financial institutions said the precautionary measures had not caused any loss of customer data or financial assets.

Nepal Rastra Bank, the country’s central bank, has urged banks and financial institutions, payment system operators, payment service providers and remittance companies to step up security measures.

In a notice issued on Friday, the central bank advised affected organisations to temporarily take websites offline where necessary and update their security systems to guard against potential cyberattacks.

“PHP is a server-side programming language widely used to run websites and online services. Serious security vulnerabilities have been found in it. Put simply, weaknesses have been identified in the systems that operate behind websites,” said Guru Prasad Paudel, spokesperson for Nepal Rastra Bank.

He said the vulnerabilities were identified when security researchers used artificial intelligence models to help test and analyse PHP code.

“In view of the risks identified in PHP, services including banks’ websites have been temporarily shut down,” the central bank said in its notice, acknowledging that the measures could inconvenience financial institutions and the public.

The bank has also urged relevant organisations, through its official social media channels, to follow security advisories, strengthen their systems and step up routine monitoring.

Why were the websites taken offline?

The vulnerabilities could allow unauthorised access to affected servers. On October 21, the US National Security Agency also advised organisations to take immediate security measures and, where the fixes could not be applied, temporarily take vulnerable services offline.

Banks and other organisations have followed those recommendations as a precaution.

The shutdowns could prevent customers from accessing information on interest rates, service charges, branches, ATMs, loan products, financial statements and other public notices. Online applications, account-opening processes and other services hosted on affected websites may also be disrupted.

However, the shutdowns do not mean that banks have suspended all their operations. The main disruption has been to websites and certain internet banking services, said Santosh Koirala, president of the Nepal Bankers’ Association.

“QR payments and mobile banking services are operating normally. The main problems concern internet banking and services linked to websites,” he said. “Some banks and financial institutions have already restored their websites after assessing the risks.”

Koirala said Nepal Rastra Bank had formally asked institutions to take websites offline temporarily and adopt the necessary security measures.

The vulnerabilities are not limited to Nepal. Websites operated by organisations elsewhere that use PHP may also be affected.

Despite the security concerns, banks and financial institutions said there had been no reported losses involving institutions, customers or other parties.

Paudel said taking a website offline was a preventive measure, not evidence that it had been hacked.

“When serious security vulnerabilities become public, the risk of exploitation increases. Organisations may therefore identify vulnerable systems, install security updates and temporarily disconnect systems from the internet if they cannot be secured immediately,” he said.

“That is why some government websites have been taken offline as a precaution. A website being offline does not mean it has been hacked. It is a temporary measure to contain the risk. The problem is not limited to older versions of PHP.”