Some Nepal Government Websites Temporarily Shut Down Over Serious PHP Security Risk

KATHMANDU – Some Nepal government websites and online systems have been temporarily shut down because of a serious security risk found in PHP technology worldwide.

The Software Development and Operation Centre (SDOC) issued an urgent security notice saying the systems were taken offline as a precaution to prevent possible cyberattacks and damage.

According to the centre, a high-severity vulnerability named “PHP@Shell” (CVE-2026-109618 and CVE-2026-109619), rated 9.2 on the Common Vulnerability Scoring System (CVSS), has been found in PHP technology. PHP-based systems around the world have been affected. The centre said the flaw creates a risk that a hacker or attacker could exploit it to run code directly on a server, without logging in, and take control of the system.

The centre said it and the related technical teams have been working continuously during the Badadashain holidays to contain the risk and update systems.

Security patches are being applied to the affected systems and technical testing is under way. Once testing is complete and the systems are fully secure, the government websites and services that were shut down will be restored gradually, the centre said. It also apologised for the inconvenience caused to service users by the sudden interruption.