Kathmandu – Several government websites and online banking services in Nepal have been temporarily taken offline after two critical security flaws were discovered in PHP, a programming language widely used to operate websites worldwide.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619 and collectively known as “PHP2Shell,” could allow attackers to execute commands and potentially take control of vulnerable servers without login credentials. They carry a critical severity score of 9.2 out of 10.
The flaws were reportedly detected with the help of advanced artificial intelligence tools during independent security research. After technical details leaked before the scheduled release of security updates, cybersecurity agencies advised organisations to install patches immediately or temporarily disconnect affected systems.
In Nepal, the Software Development and Operations Centre temporarily disabled several government websites and digital systems as a precaution. Technical teams are installing security updates, examining systems for suspicious activity and conducting tests before restoring services.
Some systems have already returned online, while the remaining websites will be restored gradually after being confirmed secure. Authorities aim to bring essential government systems back into operation before the Dashain holiday ends.
NIC Asia Bank and Siddhartha Bank also announced temporary closures of their official websites and certain online services. Both banks said risk assessments and corrective measures were under way, with services expected to resume after their systems are declared secure.
The temporary shutdowns do not necessarily indicate that the affected Nepali systems were hacked. Authorities and banks have presented the move as a preventive measure intended to protect servers, information and users while security updates are applied.
The incident has affected organisations in several countries. Government agencies, hospitals, educational institutions and other organisations have taken PHP-based systems offline, while security authorities have urged operators to update to supported PHP versions immediately.
