Nepali government agencies have taken their computer systems offline to fix two critical security flaws in PHP, software that runs a large share of websites and online services, according to a notice from SDOC.
The flaws, CVE-2026-109618 and CVE-2026-109619, were made public on the evening of Oct. 21. Either one lets an attacker run their own code on an affected server, the notice said.
According to the notice, the PHP project says there is no complete workaround and that updating is the only safe choice. Security agencies have advised that any system running PHP stay offline until it is patched.
Nepal’s National Cyber Security Centre issued an urgent advisory to the same effect on Oct. 22. It sets out how agencies should identify and patch affected systems, and how to isolate those that cannot yet be patched.
SDOC formed an immediate action team with other government centers and ministry representatives. The team agreed to take all systems offline at once to prevent any possible breach.
Work on the fixes has continued since the evening of Oct. 21, despite Dashain Tika. A few systems have already been patched and are back online, and agencies are following the cyber security centre’s guidance.
Because the shutdown came during the Dashain holidays, no government work has been affected, SDOC said.
Banks have also seen disruptions. Online account opening, corrections to customer details and some payment services were hit after bank websites were shut, bankers told Onlinekhabar in a report published Friday. The outlet tied the disruption to the PHP security risk.
Nepal Rastra Bank spokesperson Guru Prasad Paudel told Onlinekhabar that customers’ money was not at risk and no information had leaked. That claim could not be independently verified. Paudel said the bank has asked institutions to send it required details by means other than the internet.
QR payments and mobile banking were running normally, Nepal Bankers’ Association President Santosh Koirala told The Kathmandu Post. The disruption was mostly limited to website-based services and internet banking, he said.
SDOC aims to have all critical government systems patched and back online by the end of the Dashain holidays.
Have something to promote?
Bring your business, services or event to our readers.
