Nepal takes government websites offline over critical PHP flaws

Nearly 70 percent of identifiable websites use PHP, so flaws in the language can affect many systems at once. Nepal’s government treated the newly disclosed vulnerabilities as an urgent threat, even though there was no evidence that Nepali websites had been successfully attacked.

The Software Development and Operation Centre formed an emergency team with technical centres and government representatives. It temporarily shut government systems while operators checked installations and applied security updates. The flaws could let attackers run malicious code on servers without logging in.

The shutdown began on October 21 and coincided with the Dashain holidays, so the centre said government work was not affected. Some systems have been restored. The centre aims to bring back all critical services after patching them, while the National Cyber Security Centre urges organisations to upgrade affected PHP installations.

PHP is an open-source programming language that runs on web servers. It usually works invisibly, processing requests and generating the content that visitors receive. This makes PHP part of the machinery behind many websites, rather than something users directly see or operate.

For example, when someone opens a news website, the server may use PHP to find the requested article. It then assembles the webpage and sends the result to the visitor’s browser. PHP can therefore connect stored information with the page displayed on screen.

PHP matters because it is widely used in government portals, online shops, news platforms and smaller websites. It also supports major platforms such as WordPress. Many owners do not manage PHP themselves because it comes through website software or hosting services, making security updates especially important.

PHP is used by nearly 70 percent of websites whose underlying programming language can be identified, according to W3Techs. That reach makes a security problem in PHP unusually consequential. One weakness can affect organisations using the same language across very different services.

WordPress is a major example. Reuters says it is used by around 40 percent of websites worldwide, and it relies on PHP. The National Cyber Security Centre also named Joomla, Drupal and Magento as platforms that depend on the technology. These platforms can carry PHP into sites whose owners may not work with the language directly.

The figures do not mean that 70 percent of websites are compromised. Risk depends on the PHP version, installed security updates and server configuration. Still, widespread use can make it difficult for organisations to identify and fix exposure quickly.

CVE-2026-109618 and CVE-2026-109619 are identifiers for two security vulnerabilities found in PHP. Both received a 9.2 out of 10 severity score under version 4.0 of the Common Vulnerability Scoring System. That places them in the critical category.

The flaws involve PHP’s memory management and error-handling mechanisms. Under certain conditions, an attacker could send a specially crafted request. The request might exploit the way PHP handles those processes and cause the server to execute commands chosen by the attacker.

The danger is that no login or password would be needed first. Successful exploitation could expose sensitive information, change website content or compromise a server more deeply. The disclosure prompted emergency patching and precautionary shutdowns, but finding a vulnerability does not prove that a particular website was breached.

A successful attack could let someone run commands on a government server without first authenticating. Because the server controls website processes and may handle stored information, this creates risks beyond a single damaged webpage. The attacker could potentially interfere with the system’s normal operations.

The article identifies several possible outcomes. Attackers might access sensitive information, alter website content or compromise the affected system more extensively. For example, changing a public government page could spread false information, while server access could expose data held behind the website.

A compromised server could also become a foothold for further attacks. The article does not say that Nepali government servers were successfully breached. Nepal’s shutdown was preventive, giving operators time to inspect systems, apply updates and reduce the chance that attackers could exploit the PHP flaws.

Organisations took websites offline because the flaws could allow unauthorised remote code execution. Leaving an affected service publicly reachable might give attackers an opportunity to send the specially crafted requests described in the article. Temporary shutdowns reduced that immediate exposure while teams investigated and patched systems.

Nepal’s Software Development and Operation Centre formed an emergency team and decided to take government systems offline as a precaution against possible breaches. The National Cyber Security Centre separately urged organisations to check PHP installations and upgrade to patched versions.

This approach does not mean every offline website had been attacked. The advisory specifically describes prevention, not proof of successful intrusions. In Nepal, the shutdown coincided with the Dashain holidays and reportedly did not affect government work. Operators planned to restore critical systems after applying necessary security updates, and some had already done so.

Remote code execution means software on a distant computer runs commands supplied by an attacker. In this case, the affected PHP server could process a specially crafted request and execute malicious code even though the attacker was not logged in. The attacker interacts through a network rather than physically accessing the machine.

The mechanism matters because the server performs the attacker’s instructions using its own capabilities. That could expose sensitive information, change website content or damage the wider system. The article also warns that a compromised server could become a foothold for further attacks.

This is among the most dangerous vulnerability types because it combines remote access with command execution and may require no password. The two PHP flaws received critical 9.2 scores. Still, exploitation is only a possibility described by the vulnerability, not proof that a particular Nepali website was breached.