PHP2Shell security flaw forces thousands of Nepali websites offline

PHP2Shell is the name used here for a serious PHP security problem. The article identifies two critical vulnerabilities disclosed by the PHP Foundation, which maintains PHP. It does not explain their precise technical method, but it says they created a risk of exploitation. That matters because PHP runs many websites and online services.

The immediate response was defensive. Government agencies, banks and other organisations took vulnerable websites offline, installed security updates and audited systems. Nepal’s Vehicle Consignment Tracking System was suspended because of serious vulnerabilities in PHP and related technologies. The National Cyber Security Centre also instructed organisations to update their systems.

No PHP2Shell-linked unauthorised access or cyberattack had been reported in Nepal. However, keeping systems offline reduced the immediate risk while engineers tested patches. Older PHP versions, including 8.1 and earlier, made the work harder because official security fixes were unavailable. Services were expected to return in stages after patching and testing.

Thousands of websites and digital services in Nepal were taken offline, although the article gives no exact total. The shutdown affected government portals, ministries, departments, commissions and other offices. Nepal Rastra Bank’s official website and web-based services were also suspended.

Private banks and financial institutions announced that they had shut down websites and digital services while improving security. The Department of Revenue Investigation also suspended the Vehicle Consignment Tracking System, or VCTS, which tracks freight vehicles. Because many government sites use one shared template, authorities could remove them from public access centrally.

The scale made the disruption unusually broad. Systems not using PHP were brought back online from October 22, while other systems underwent audits. The Software Development and Operation Centre expected thousands of government websites to return together after central patching, potentially from Sunday evening through Monday or Tuesday. Restoration depended on updates and testing.

Organisations acted before an attack was reported because the vulnerabilities were considered critical. The PHP Foundation disclosed them and released security patches on October 21. A vulnerable system left online could face exploitation, so shutting it down was a precaution designed to limit exposure while fixes were prepared.

Nepal’s National Cyber Security Centre said there had been no unauthorised access or cyberattacks linked to the issue in Nepal. Even so, it instructed organisations to update their systems. Banks, financial institutions, government agencies and service providers also increased security monitoring and suspended online services.

The timing reduced public disruption because the shutdown occurred during the week-long Dashain holiday, when government offices were closed. Engineers used the period to audit shared platforms, install patches and test systems. Websites were to return in stages, although officials remained uncertain whether every government site would be operational when offices reopened.

An outage removes access to information and services that people, businesses and government agencies use online. The article says the shutdowns disrupted public information and public services. Banking customers and institutions faced unavailable websites and digital services, while agencies had to strengthen security before restoring access.

VCTS provides freight-vehicle tracking, so its suspension affected relevant service users, taxpayers and agencies. The Department of Revenue Investigation said vehicles could continue operating with required bills, invoices and other documents. After the system returns, users and agencies must issue VCTS records as required without delay.

The central bank’s outage also affected access to Nepal Rastra Bank’s website and web-based services. Private banks and financial institutions separately shut online systems while improving security. These interruptions were temporary, but restoration depended on patching, audits and testing. Delays could continue until systems were judged safe to bring back online.

PHP is a programming language widely used to build and run websites. It helps power the software that delivers website pages and online services. The article does not provide a deeper technical explanation, but its widespread use explains why a PHP security issue affected so many organisations.

In Nepal, thousands of government websites run on the shared GIWIMS platform, and many systems use PHP. Nepal Rastra Bank, private financial institutions and the VCTS service were among the affected systems. When the vulnerabilities became known, organisations had to examine whether their PHP-based software was exposed.

PHP’s broad presence made the response both large and coordinated. Systems that did not use PHP were brought back online from October 22, while other systems underwent audits. The PHP Foundation released security patches, and engineers planned central updates for shared government platforms. Wider use also means careful updating is essential whenever serious flaws are discovered.

An unsupported PHP version is harder to secure because the PHP project no longer provides official patches or fixes for newly identified weaknesses. The article names PHP 8.1 and earlier as versions that have reached the end of their supported life. Without maintained updates, administrators have fewer direct ways to correct vulnerable code.

The government IT engineer said PHP had suggested temporary measures for older versions, but recommended upgrading and installing the patch as the better long-term solution. This means an organisation may need to change its software before applying the current security fix. Older systems can therefore require more time for review, testing and compatibility work.

That problem contributed to uncertainty about when Nepal’s websites could return. Systems were kept offline while audits, patching and testing continued. The SDOC planned staged restoration. The episode shows why organisations need to track software support dates and avoid relying indefinitely on temporary workarounds.

A shared platform means many separate government websites rely on common underlying technology. In Nepal, most government websites run on GIWIMS, according to the Software Development and Operation Centre. This arrangement lets authorities manage the sites centrally rather than treating every ministry or office as a completely separate system.

The same structure enabled a rapid shutdown. Once the PHP problem became known, authorities could take affected systems offline through the shared platform. Engineers from the SDOC, National Cyber Security Centre and Integrated Data Management Centre then audited GIWIMS and prepared a central patch. Systems that did not use PHP were restored earlier.

Central management can also speed recovery, but only after testing confirms the platform is safe. Kiran Timilsina said the necessary technical decisions would be made by Sunday evening. Once GIWIMS was patched centrally, thousands of websites could return together from Sunday evening through Monday or Tuesday. Restoration still depended on audits and testing.