Banks and government agencies take websites offline over PHP security flaws

PHP is a programming language used on servers. It helps websites and online services operate behind the scenes. The article describes it as widely used, so a problem in PHP can affect many organisations at once. It matters because server-side software handles parts of a website before information reaches a visitor’s device.

For example, a bank website may use PHP to deliver public notices, account-opening pages or other online services. When PHP contains a serious weakness, an attacker may target the server running that website. The article says the vulnerabilities could allow unauthorised access to affected servers. Researchers identified the flaws while using artificial intelligence models to test and analyse PHP code.

The article does not identify specific PHP functions or exact flaw types. It reports that organisations were urged to install security updates, strengthen systems and monitor them routinely. Some websites were temporarily disconnected while risks were assessed, but being offline did not mean they had been hacked.

The precaution affected websites operated by banks, financial institutions and government agencies in Nepal. The Employees Provident Fund and the Social Security Fund were specifically named. Other government agencies also took websites offline after serious PHP vulnerabilities were discovered. Nepal Rastra Bank directed relevant organisations to strengthen their defences.

The warning extended beyond ordinary banks. It covered payment system operators, payment service providers and remittance companies. These organisations may run websites or online services using PHP. Taking a site offline was recommended where necessary, especially when the organisation could not immediately apply a fix or confirm that its systems were safe.

The disruption mainly involved websites and some internet banking services. QR payments and mobile banking continued operating normally, according to the Nepal Bankers’ Association president. Some banks had already restored their websites after assessing the risks. The article reports no losses involving institutions, customers or other parties.

The article does not provide technical names for the PHP weaknesses. It says serious security vulnerabilities were found in the systems operating behind websites. The central risk was unauthorised access to affected servers. That matters because a compromised server could expose or disrupt services hosted on it.

The article gives a clear mechanism at a high level. Attackers could exploit a weakness in PHP, the server-side software used by a website, to reach a vulnerable server without permission. Security researchers found the vulnerabilities while using artificial intelligence models to test and analyse PHP code. The US National Security Agency later advised immediate protective action.

The exact exploitation steps, affected PHP versions and possible data-access details are not stated. Organisations therefore followed general defensive measures: applying security updates, strengthening systems, monitoring them and disconnecting vulnerable services when fixes were unavailable. No losses involving institutions, customers or other parties were reported.

Banks and government agencies disconnected websites to reduce the chance of cyberattacks while they assessed and fixed PHP weaknesses. Once serious vulnerabilities become public, attackers may look for systems that remain exposed. Nepal Rastra Bank therefore advised organisations to take websites offline where necessary and update their security systems.

The US National Security Agency gave similar advice on October 21. It recommended immediate security measures and temporary disconnection when fixes could not be applied. In practice, an organisation could identify vulnerable systems, install updates and temporarily remove them from the internet. This limits exposure while security teams work on the problem.

The shutdowns affected public information, online applications and some internet banking services. They did not suspend all banking operations. QR payments and mobile banking continued normally, and some websites were restored after risk assessments. The central bank stressed that an offline website had not necessarily been hacked; disconnection was a precaution to contain risk.

The shutdowns did not stop every banking service. QR payments and mobile banking continued operating normally, according to Santosh Koirala of the Nepal Bankers’ Association. Banks and financial institutions also continued their broader operations. The main disruption involved websites and services connected to them.

Customers could be unable to view interest rates, service charges, branch and ATM details, loan products, financial statements or public notices. Online applications and account-opening processes hosted on affected websites could also stop working. Some internet banking services were disrupted, depending on whether they relied on the affected systems.

The situation remained temporary and varied between organisations. Some banks and financial institutions restored websites after assessing their risks. Banks reported no loss of customer data or financial assets, and no losses involving institutions, customers or other parties were reported. Organisations were expected to strengthen security, apply updates and resume services safely.

The first response is not always shutdown. An organisation can identify vulnerable systems, install available security updates, strengthen its defences and follow security advisories. Nepal Rastra Bank also urged routine monitoring. These steps can reduce exposure while a website remains available, provided the organisation can secure and assess the affected systems.

The article describes the key decision point. If a fix can be applied, the organisation should update its security systems and check the risks. If the vulnerable service cannot be secured immediately, it should be temporarily disconnected from the internet. The US National Security Agency gave the same type of advice on October 21.

Temporary disconnection limits opportunities for attackers while work continues. It can inconvenience customers by blocking public information, online applications or internet banking. However, the measure is preventive, not evidence of a breach. Once risks are assessed and systems are secured, organisations can restore websites, as some banks already had.

In general, a web server receives a request from a user’s browser and decides what response to provide. Server-side software such as PHP runs on that server, processes the request and helps generate the page or service sent back. The article specifically describes PHP as server-side software operating behind websites.

A flaw in that software can affect every website using the vulnerable component, not just one organisation. If the software mishandles a request, an attacker may exploit that weakness to gain unauthorised access to a server. The article does not describe the exact request-processing flaw, but it confirms that PHP vulnerabilities could expose affected servers to cyberattacks.

This shared risk explains the broad response in Nepal and elsewhere. Banks, government agencies and other organisations had to identify vulnerable systems, apply updates or disconnect services temporarily. The article says PHP websites outside Nepal may also be affected. The scope depends on which systems use the vulnerable software.