Most Nepal government websites back online after PHP2Shell flaw

Nepal temporarily shut down many government websites after PHP2Shell, a critical vulnerability in widely used website software, came to light. The precaution was meant to reduce the risk of unauthorised access and cyberattacks while officials checked and secured affected systems. Government and banking websites were both taken offline during the response.

The Software Development and Operation Centre patched thousands of websites connected through the shared Government Integrated Website Management System. It also completed security updates and audits. The Integrated Data Management Centre, which hosts most agencies’ websites, servers, and systems, addressed the PHP issue and helped restore portals.

Most websites are now live, but the Medical Education Commission’s website and the Nagarik App remain inaccessible. Other sites managed by outside vendors must be restored by those vendors or individual agencies. Officials say they are contacting responsible teams and bringing remaining services back gradually.

PHP2Shell is the name given to a critical security vulnerability in PHP, a programming language widely used to build websites. A vulnerability is a weakness that attackers may exploit. In this case, the flaw mattered because affected websites could face unauthorised access or cyberattacks. The article does not describe the exact code-level mechanism behind PHP2Shell.

The danger became clear when the vulnerability came to light last Wednesday. Nepalese authorities responded by temporarily taking government and banking websites offline. They used the shutdown as a precaution while applying security updates, auditing systems, and assessing the risk to public services.

The response shows why a flaw in common software can have broad effects. Officials patched thousands of government websites centrally through the Government Integrated Website Management System. Most sites returned online afterward, but some vendor-managed services and public applications still require separate restoration. The article says authorities are continuing that work.

The affected network covered thousands of government websites operating under the shared Government Integrated Website Management System, or GIWMS. The article does not provide an exact website count. It also identifies the Integrated Data Management Centre as the central host and storage location for most government agencies’ websites, servers, and systems.

This shared arrangement allowed the Software Development and Operation Centre to apply security updates centrally. Rather than handling every website separately, officials patched the sites operating through GIWMS and then brought most of them back online. The centre also completed security updates and audits as part of the response.

The scale made the vulnerability important beyond one agency or portal. A single PHP security issue affected a large group of connected government services. However, the central system did not cover every restoration task. Sites managed by individual offices or outside vendors still needed their own technical teams to apply changes and restore access.

Security patches repaired the PHP weakness that had prompted Nepal’s precautionary website shutdowns. The Software Development and Operation Centre completed the necessary updates and audits, then restored most government portals. The patches addressed the shared software problem rather than requiring every centrally managed website to be rebuilt.

The clearest example is the GIWMS network. Thousands of government websites operating through it were patched centrally. After the updates, officials brought most of those sites back online. The Integrated Data Management Centre also confirmed that it had addressed the PHP security issue and was restoring websites in response to agency requests.

Patching did not instantly restore every service. Websites managed by individual offices or vendors still needed their own teams to complete restoration. Most sites are now live, but the Medical Education Commission website and the Nagarik App remain unavailable. Officials say they are gradually restoring other services as requests and technical work are completed.

Central patching restored websites covered by the shared Government Integrated Website Management System, but not every service could be recovered from one location. Some government systems are managed by individual offices, vendors, or separate technical teams. Those groups must carry out their own restoration work after the common PHP issue is addressed.

The SDOC said systems requiring individual offices, vendors, or technical teams were gradually coming back. It specifically said some vendor-managed sites remained inaccessible and that officials were contacting the responsible vendors. The Medical Education Commission’s website and the Nagarik App were also still unavailable after the central patching was completed.

This means fixing the vulnerability was only one step. Services also need their operators to restore access and respond to requests. The Integrated Data Management Centre said most websites were live and that it was restoring others gradually for relevant agencies. The article gives no specific timetable for the remaining services.

Several organizations shared responsibility for the response. The Software Development and Operation Centre identified the need for security updates, completed patches and audits, and restored most portals. The Integrated Data Management Centre centrally hosts and stores most government agencies’ websites, servers, and systems, and confirmed that the PHP issue had been addressed.

Kiran Timilsina, the SDOC’s chief executive officer, described the central restoration of thousands of GIWMS websites. Shivaji Kumar Gupta Rauniyar, the Integrated Data Management Centre’s information technology director, said most sites were live and that others were being restored after agency requests. Their comments explain how central infrastructure and agency-level work were combined.

Individual government offices, vendors, and technical teams remained responsible for systems outside the central restoration process. Some vendor-managed websites were still inaccessible, so officials were contacting those vendors. The Medical Education Commission website and Nagarik App also remained unavailable, with no separate responsible team identified in the article.

PHP is a programming language commonly used to create websites and generate web content. Because many unrelated websites can be built with the same software, a security flaw in PHP can affect a broad range of services at once. The article identifies PHP as widely used and says PHP2Shell created risks of unauthorised access and cyberattacks.

Nepal’s government websites provide a concrete example. Thousands of sites operating through the shared GIWMS used the affected software. Authorities temporarily took government and banking websites offline, then applied security updates and audits. The SDOC patched the GIWMS sites centrally, while the Integrated Data Management Centre addressed the issue across hosted systems.

Most websites returned online after the PHP issue was addressed. Still, shared software does not mean every system can be restored centrally. Vendor-managed services and individual agency systems require separate work. The article does not explain PHP’s internal operation or PHP2Shell’s precise exploit, but it shows how common software can create widespread security and recovery challenges.