Thousands of government and banking websites in Nepal have been taken offline as a precaution after two critical security vulnerabilities were discovered in PHP, a programming language widely used to build and run websites.

The PHP Foundation, which maintains the language, disclosed the vulnerabilities and released security patches on October 21. Websites began going offline around the world as governments, financial institutions and other organisations moved to protect their systems against potential attacks.

In Nepal, thousands of government websites run on a shared template, allowing authorities to take them offline centrally. As a result, web portals operated by ministries, departments, commissions and other government offices have become inaccessible.

Nepal Rastra Bank’s official website and web-based services have also been temporarily suspended. Private banks and financial institutions have issued notices saying they have shut down their websites and digital services while strengthening security.

The Vehicle Consignment Tracking System (VCTS), operated by the Department of Revenue Investigation to track freight vehicles, is also offline. The department said it had suspended the service because of serious security vulnerabilities in PHP and related technologies, citing the risk of exploitation.

“Vehicles may continue to operate with the relevant documents, including bills and invoices issued in accordance with existing rules. Once the system is back online, the relevant service users, taxpayers and agencies must issue VCTS records as required without delay,” the department said in a notice.

The service will resume after the necessary security updates have been installed, the department said.

The central bank has urged all banks and financial institutions, payment system operators and service providers to step up security monitoring of their systems.

It remains uncertain whether all government websites will be operational when offices reopen on Monday after the week-long Dashain holiday. The Software Development and Operation Centre (SDOC), under the Office of the Prime Minister and Council of Ministers, expects thousands of government websites to return online together by Monday or Tuesday.

Kiran Timilsina, the centre’s chief executive officer, said systems that do not use PHP had been brought back online from October 22, while the remaining systems were undergoing audits.

Keeping the websites offline during the holiday had helped limit the immediate risks and disruption, he said.

“Most Nepal government websites run on a shared platform called GIWIMS, which is now being audited,” Timilsina said. “The necessary technical decisions will be taken by Sunday evening. Once we patch the platform centrally, thousands of government websites will come back online together, from Sunday evening through Monday or Tuesday.”

The holiday had helped minimise inconvenience to the public because government offices were closed, he said. Work was under way to restore the websites before offices reopened on Monday.

Engineers from the National Cyber Security Centre and the Integrated Data Management Centre are also working with the SDOC to restore the systems safely, the heads of the agencies told Kantipur. They said they had begun taking systems offline as soon as they learned of the PHP problem on the day of Dashain tika.

The National Cyber Security Centre issued an advisory on October 22 and designated its computer officer, Ashish Bhatt, as the focal person to coordinate the response, said Raj Kumar Maharjan, the centre’s director and spokesperson. The centre has instructed organisations to update their systems.

“The systems were shut down as a precaution,” Maharjan said. “There have been no cases of unauthorised access or cyberattacks in Nepal linked to this issue so far.”

The shutdowns have nevertheless disrupted online information and public services.

One challenge is that some systems run on older PHP versions, including version 8.1 and earlier, which have reached the end of their supported life and no longer receive official security updates from the PHP project.

“Because PHP 8.1 and older versions are no longer supported, official security patches or fixes are not available for them,” a government IT engineer said. “Although PHP has suggested some temporary measures for older versions, upgrading to a newer version and installing the patch is a better long-term solution than relying on workarounds. But that takes time.”

The SDOC has said systems will be restored in stages after security patching and testing are complete.

A patch is a software update released by developers to correct errors or close security vulnerabilities in a programme’s code. Such updates are commonly called security patches. Since official patches are not generally available for obsolete PHP versions, systems running them may need to be upgraded to a supported version before they can be secured. 

Why is the restoration taking so long? 

On the evening of October 21, the PHP Foundation disclosed two security vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619. Together, they are known as PHP2Shell.

Developers typically release patches when disclosing security flaws. But distributing and activating an update across different servers, cloud systems and user environments can take time, Timilsina said. Depending on the systems involved, it can take anything from a few hours to a week for patches to reach all affected infrastructure and be applied.

This delay has slowed the restoration of websites taken offline as a precaution.

“We installed the patch on the centre’s website and some other systems on the night of October 21 and brought them back online,” Timilsina said. “Other systems, such as mail servers that do not use PHP, were restored the following day. The remaining systems are being audited.”

Installing a new security patch alone is not enough to resolve the problem in older systems, he said. The centre had also found that source code for some legacy systems had not been audited.

“We are prioritising source-code audits to identify other potential vulnerabilities that may already exist in these older systems, alongside upgrading them to newer versions,” he said.

For systems covered by annual maintenance contracts, the relevant vendors are responsible for addressing the problem, with the SDOC providing coordination and support. For systems without such contracts, the centre is reviewing source code and handover documentation before deciding how each should be handled.

“Systems belonging to essential agencies, such as the Public Service Commission, need to be brought back online quickly,” Timilsina said. “The holiday has delayed access to documentation and hosting details, but the systems should be back online by Sunday and Tuesday.”

Some banks, including Nabil Bank, Sanima Bank and Nepal Investment Mega Bank, have already updated their systems and resumed services after temporary disruptions. 

How did the vulnerability emerge? 

International media reports, citing cybersecurity firm Wiz, say PHP powers more than 70 percent of websites worldwide.

According to Wiz, a cybersecurity research firm owned by Google, the global alert was triggered by long-standing flaws in PHP’s core engine. 

If exploited, the flaws could allow attackers to execute code on vulnerable servers and steal sensitive data. Security advisories say the vulnerabilities can be exploited remotely without authentication.

In a BBC report, technology reporter Liv McMahon and business reporter Osmond Chia said the flaws had gone undetected for years and were difficult for human researchers to identify. The vulnerabilities came to light with assistance from OpenAI’s artificial intelligence models and researchers from Wiz and Calif.

The discovery triggered a global response. The BBC reported that websites and online services had been taken offline in several countries, including Finland and the Netherlands, as organisations worked to secure their systems. Japan’s telecommunications and IT provider SoftBank Corp also suspended earthquake, tsunami and other emergency alert services until Monday, according to the report.

International cybersecurity agencies, including the US National Security Agency, have advised organisations to isolate systems that cannot be patched immediately from the internet.

The PHP Foundation has released patched versions of the language, including PHP 8.2.35 plus, 8.3.36 plus, 8.4.27 plus and 8.5.12 plus.

Cybersecurity specialists say organisations should first identify which PHP version is running on their servers, then use official scanning tools to determine whether their systems are vulnerable.

Once a vulnerability is confirmed, the system should be upgraded to a secure PHP version. Maharjan said users should download and install patches only from official PHP links or trusted package managers, not from unauthorised or suspicious sources.

Installing a patch is not enough on its own. PHP-FPM, Apache and all other PHP services running in the background must also be restarted to ensure the updated security code takes effect.

The National Cyber Security Centre’s advisory provides step-by-step instructions for carrying out these checks and updates.