On Thursday morning, .gov.np websites became inaccessible, including those of the Office of the President, the Office of the Prime Minister, several ministries and many municipalities. Nepal was not alone. Finland shut down public web services, the Dutch cybersecurity agency took its own website offline, and Japan’s Prime Minister took to X to urge organisations to apply security patches that night.
The cause was two critical flaws in Hypertext Preprocessor (PHP), the programming language behind a large share of the world’s websites, including most WordPress sites. Discovered with the help of AI, the flaws allowed attackers to take control of web servers without passwords. A fix was released on Wednesday, and agencies worldwide issued the same advice: update immediately or take systems offline until they can be secured.
In Nepal, the government’s Software Development and Operations Center (SDOC) issued an urgent notice and took websites offline as a precaution. Its teams have worked through the Dashain holidays to patch and test systems, restoring services as each is confirmed secure.
That was the responsible decision. A day offline is far better than stolen data or defaced official websites. But the episode should prompt a harder conversation, in both government and the private sector.
Related story
Apple to patch privacy bug in video-calling feature
The Patch Is the Easy Part
I have seen the same pattern many times. Getting a patch is rarely the problem. The difficulty lies in everything around it: finding every system that needs it, understanding what depends on those systems and knowing what might break when the update is applied.
In Nepal, that challenge is particularly acute. PHP is the workhorse of our web industry. Thousands of websites belonging to government offices, banks, cooperatives, schools, hospitals and businesses run on it, often built by vendors whose contracts ended long ago. Many likely use older PHP versions that no longer receive security updates. Ask a typical office who is responsible for its website’s security, and you may not get a clear answer.
That is why a fix released within hours can leave websites offline for days. Organisations recover quickly only when they know which systems they run, who maintains them and how to update them safely.
Researchers used AI to discover flaws that had remained undetected in PHP for more than a decade. Attackers have access to the same tools, and the gap between a vulnerability becoming public and criminals exploiting it is shrinking to hours. Nepal’s small pool of experienced cybersecurity professionals cannot be everywhere at once. Organisations need to know their systems well enough to act as soon as an alert is issued, and they should start using AI for defence, too.
What Should Change
Nepal has made progress on paper. The 2023 National Cyber Security Policy envisions a National Cyber Security Centre, while Nepal Rastra Bank’s Cyber Resilience Guidelines set expectations for banks. This week’s events show what needs to happen next to turn policy into practice.
First, every government body and regulated institution should maintain an up-to-date inventory of its internet-facing systems, including the software each runs and who is responsible for it. This sounds basic, yet few organisations anywhere can produce such an inventory quickly.
Second, vulnerability management must become a formal, funded function, with a named owner, agreed deadlines for fixing critical flaws, an emergency budget and a tested plan for taking systems offline safely. It cannot be left to whoever happens to be available.
Third, security must be built into contracts. Government procurement should require maintenance throughout a system’s life cycle, and hosting providers, web agencies and vendors should be required to confirm in writing that critical security patches have been applied. Too many public websites are built, paid for and then forgotten.
Finally, boards and senior officials must take responsibility. When a software flaw takes the Prime Minister’s own website offline, the issue has moved well beyond the IT department.
Many readers run a business, school, clinic or cooperative with a website. If that includes you, contact your web developer or hosting company this week and ask: Does our website use PHP? Which version does it run, and has the security update been applied? Get the answers in writing. If you use WordPress or a similar platform, update it and its plugins, change administrator passwords and remove unused accounts. If nobody can answer these questions, that tells you something about who is looking after your website.
Everyone else should stay alert. Scammers may use news like this as cover. Be wary of calls or messages offering a “security update” on behalf of your bank, a government office or a technology company, and never share your password or one-time password (OTP).
The patches will be applied, and the .gov.np websites will return. This story will soon fade, but the question it raises deserves an answer. Every ministry, bank, cooperative and business in Nepal should be able to say, within an hour, what systems it runs and who is responsible for keeping them secure.
If the answer this week was uncertain, that is the problem to fix first.
The author is a cybersecurity professional with 26 years of experience and a technology and security leader at Genese Solution, a UK-based global technology consulting firm operating in more than a dozen countries, including Nepal.