Government websites resume services following PHP security patch

Most government websites and online services in Nepal had resumed operation by Monday, October 26, when offices reopened after the extended Dashain holiday, following a shutdown prompted by a critical security flaw in the PHP programming language. The Software Development and Operations Centre (SDOC) had taken systems offline the previous Thursday as a precaution against possible cyberattacks and data loss, according to My Republica.

Subash Dhakal, acting head of the Office of Information Technology and Electronic Governance, told BBC News Nepali that more than 900 websites were back. Work was continuing on the Public Service Commission, Passport and Transport Management systems, and the sites at highest risk were restored first. He described the shutdown as a precaution and said there was no cause for great alarm. The flaw, called PHP2Shell, lets attackers run code on a server without logging in, according to cybersecurity experts cited by BBC News Nepali.

Lingering disruptions

While central government portals are largely back online, the restoration has not been uniform. My Republica reported that the online recommendation system was still down at Ward 31 of Kathmandu Metropolitan City. Suresh Sahu Shrestha, the ward secretary, said staff were typing, printing and issuing documents by hand to avoid delays for the public.

Onlinekhabar's analysis cited two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, which it said the PHP team rated 9.2 out of 10 and called critical. It reported that about 35 percent of PHP sites run PHP 7 or older, which no longer receives official updates (W3Techs), leaving them exposed. Onlinekhabar also argued that artificial intelligence tools lower the effort needed to exploit such flaws.

Future infrastructure security

Dhakal said the office is working on a separate framework for critical information infrastructure: classifying such systems, then setting standards for each tier. He said the work is tied less to the current PHP problem than to identifying the risk level of systems overall, and that building internal capacity is a priority.

Santosh Sharma, quoted by BBC News Nepali, said a security plan for critical information infrastructure is important and that countries choose sectors by priority. National security, finance and the economy could rank above the threshold, he said, and for Nepal energy could matter. Dhakal said the office is coordinating with the National Cyber Security Centre, SDOC and others on the current problem. Asked whether the restored sites are fully secure, he said other risks remain but the patch protects against this one.