Nepal’s government websites are gradually returning online after authorities applied security patches to a critical vulnerability in PHP, a programming language widely used to build websites, following precautionary shutdowns to guard against potential cyberattacks.

The Software Development and Operation Centre (SDOC) said it had completed the necessary security updates and audits and restored most government portals. However, some services, including the Medical Education Commission’s website and the Nagarik App, remain unavailable.

Kiran Timilsina, chief executive officer of the SDOC, said thousands of government websites operating under the shared Government Integrated Website Management System (GIWMS) had been patched centrally and brought back online. “We have brought government websites back online,” Timilsina said. “Systems that individual offices need to restore through their own vendors or technical teams are also gradually coming back, and most sites are now online. Some sites managed by vendors remain inaccessible, and we are contacting them.”

Shivaji Kumar Gupta Rauniyar, information technology director at the Integrated Data Management Centre, which centrally hosts and stores most government agencies’ websites, servers and systems, also said most government websites had been restored after the PHP vulnerability was addressed. “We have addressed the PHP security issue and are proceeding accordingly,” Rauniyar said. “Most websites are live, and we are restoring others gradually in response to requests from the relevant agencies.”

The vulnerability, known as PHP2Shell, came to light last Wednesday, raising concerns about potential unauthorised access and cyberattacks. Government and banking websites were temporarily taken offline as a precaution while authorities worked to address the security risk.