Nepal’s government has temporarily taken its online systems offline to address two critical security flaws in PHP, a programming language used by nearly 70 percent of websites whose underlying technology can be identified.
The government began emergency security work on the evening of October 21 after the vulnerabilities became public. Some systems have since been patched and brought back online, according to the government’s Software Development and Operation Centre.
In a notice issued on Thursday, the centre, which operates under the Office of the Prime Minister and Council of Ministers, said it had formed an emergency team with other technical centres and government representatives to secure affected systems. The team decided to take government systems offline as a precaution against possible breaches.
The centre said the shutdowns coincided with the Dashain holidays and had not affected government work. It aims to restore all critical systems after applying the necessary security updates.
The National Cyber Security Centre issued an urgent advisory on October 22, asking organisations to check their PHP installations and upgrade to patched versions. The warning covers not only websites running PHP directly but also platforms such as WordPress, Joomla, Drupal and Magento that rely on the technology.
The advisory does not establish that Nepali websites have been successfully attacked. It is a preventive measure intended to reduce the risk of unauthorised access.
What is PHP, and why does it matter?
PHP is an open-source programming language that runs on web servers. It works behind the scenes to generate the content users see when they open a website.
When someone visits a news website, for instance, the server may use PHP to retrieve the relevant article, assemble the page and send it to the visitor’s browser. Users generally do not see or interact with the underlying code.
PHP’s widespread use makes security flaws in the language particularly consequential. According to web technology tracker W3Techs, nearly 70 percent of websites whose programming language can be identified use PHP. The language also underpins WordPress, the content management system used by around 40 percent of websites worldwide, according to Reuters.
Its reach extends from personal blogs and small business websites to government portals, online shops and news platforms. Many website owners do not manage PHP themselves because the technology is built into the software or hosting services they use.
The figures do not mean that 70 percent of websites have been compromised. The actual risk depends on the PHP version running on a server, whether the relevant security updates have been installed and how the system is configured.
However, a flaw in a widely used component can expose a large number of systems to the same type of attack, making it difficult for organisations to assess and address their risks quickly.
What are the security flaws?
The two vulnerabilities have been assigned the identifiers CVE-2026-109618 and CVE-2026-109619. Both received a severity score of 9.2 out of 10 under the Common Vulnerability Scoring System, version 4.0, placing them in the critical category.
The principal concern is that an attacker could execute malicious code remotely on an affected server without first logging in or supplying a password.
The vulnerabilities involve PHP’s memory management and error-handling mechanisms. Under certain conditions, a specially crafted request can exploit weaknesses in how the software handles these processes, potentially allowing an attacker to execute commands on the server.
If exploited successfully, the flaws could give attackers access to sensitive information, allow them to alter website content or compromise the affected system more extensively. A compromised server could also become a foothold for further attacks.
The security risk prompted an urgent response from website operators and cybersecurity agencies, even though the discovery of a vulnerability does not in itself prove that a particular website has been breached.
Why were websites taken offline around the world?
Nepal’s response followed similar precautionary measures in other countries after the flaws were disclosed on October 21.
According to Reuters, government, school and hospital websites in several European countries were taken offline while their operators worked to apply security fixes. The countries affected included Germany, France, the Netherlands, Finland and the Czech Republic.
Other organisations also restricted access to online services. These included parts of Japan’s government services, websites operated by British public bodies and services run by the Wikimedia Foundation, which operates Wikipedia.
In Germany, a government spokesperson said the temporary shutdowns were precautionary and that no security incidents were known to have occurred at the time. Dutch public-facing websites, including hospital sites, were also taken offline as organisations followed cybersecurity guidance.
The response was driven by the possibility that attackers could exploit the flaws before operators had time to secure their systems. Taking a vulnerable service offline reduces its exposure to the public internet while updates are installed and verified.
The European Union’s cybersecurity agencies advised organisations to identify applications using PHP, coordinate with hosting providers and prioritise systems accessible from the internet. Where patches could not be applied immediately, they recommended isolating affected services until the risks could be addressed.
More recently, The Guardian reported that website operators had faced millions of attempts to exploit the vulnerabilities. Its report said major successful breaches had not been publicly identified, although the attempts highlighted the urgency of securing vulnerable systems.
What should Nepali website operators do?
The National Cyber Security Centre has directed organisations to upgrade their PHP installations to the latest patched releases appropriate to their systems.
The versions specified in its advisory are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35, or later releases in those branches.
The centre said PHP 8.1 and older versions do not have the required fixes available through the advisory and should be moved to a newer, secure version.
Organisations unable to apply the updates promptly have been advised to restrict public access to vulnerable services or isolate them from the internet until they can be secured.
The warning is relevant to government offices, media organisations, businesses and other institutions running their own websites. Those using third-party hosting services may also need to contact their providers to confirm which PHP version is in use and whether the security updates have been applied.
The immediate challenge is not simply installing a patch. Organisations must also identify every system running the vulnerable software, including applications that depend on PHP indirectly, and ensure that the updated version is actually running.
The episode demonstrates how a security flaw in a widely used component can trigger disruptions far beyond the organisations that develop or maintain it. For Nepal, the priority is to complete the security updates, restore affected government services and establish that the systems are protected before they are made publicly accessible again.