KATHMANDU, Oct 27: Most government websites that were temporarily shut down as a precaution after a serious security flaw was found in PHP, a programming technology used to build websites, have resumed operations.
Following security updates and testing, government websites have begun coming back online, but several portals and applications, including Nepal Rastra Bank, the Medical Education Commission and Nagarik App, remain unavailable.
On October 21, reports emerged of a security vulnerability called “PHP to Shell” in PHP technology. Government and banking sector websites were temporarily taken offline to prevent potential cyberattacks and data theft. Most government websites have since resumed operations after security patches were installed across thousands of sites running on a shared web infrastructure.
Government websites return after security updates
The Software Development and Operation Centre (SDOC) said it had installed the necessary security patches, completed audits and brought most government portals back online. Thousands of websites under the Government Integrated Website Management System (GIWMS) have been updated centrally and restored, according to the centre.
Although most government websites are accessible again, not all services have returned to normal. Users are still facing problems accessing some services and viewing information. Websites managed by individual vendors or technical teams remain offline because their security updates and testing have yet to be completed.
Shivajikumar Gupta Rauniyar, information technology director at the Integrated Data Management Centre, also said work was underway to address the PHP vulnerability and that most government websites had resumed operations.
Related story
Sajilo Pay launches Nepal’s first multilingual payment app
The Department of Foreign Employment's website, which had been temporarily shut down, resumed operations on Monday. Other government websites are also gradually coming back online.
Rastra Bank website outage disrupts access to exchange rates
Despite the restoration of most government websites, Nepal Rastra Bank's official website remained offline as of Monday. The outage has inconvenienced stakeholders in the banking and financial sectors as well as the general public, particularly those seeking foreign currency exchange rates. Since taking its website offline, the central bank has been publishing exchange rates through social media.
Concerned about security risks, Nepal Rastra Bank, banks and financial institutions, payment service providers and remittance companies had also temporarily shut down their websites and some internet-connected systems. Bankers said the disruption affected online banking, new account openings, know your customer (KYC) updates and some payment services.
On Friday, Nepal Rastra Bank issued an urgent notice directing banks and financial institutions, payment service providers and remittance companies to exercise caution when connecting their systems to the internet. It also instructed them to submit reports to the central bank offline.
The central bank and bankers have described the website shutdowns as a precautionary measure. They said the decision did not stem from problems with banks' core banking systems. No evidence has been made public of money being stolen from customers' bank accounts or personal information being leaked.
Banks restore services after security updates
Bankers said institutions worldwide were updating PHP based websites to address the vulnerability. Banks and financial institutions that have completed the required security updates have restored their websites and some suspended services. Those yet to finish the updates have kept their websites offline to contain potential risks.
Anil Sharma, chief executive officer of the Nepal Bankers' Association, said hackers could gain control of website data or steal sensitive information if institutions failed to install security updates promptly after a vulnerability was identified.
“Once this problem emerged globally, Nepali banks also took timely precautions by updating their websites and keeping them offline until the updates were completed,” he said.
According to Sharma, banks focused on securing website sections containing customer and public information while carrying out the updates. Institutions that have completed the process have restored their websites, while some are still working on it.
The vulnerability affected PHP-based websites, prompting institutions to update their security versions. Those needing more time to complete the process temporarily shut down their websites. Bankers said the core banking systems remained unaffected and that institutions had prioritised website security.
Global alert after AI-assisted discovery of vulnerability
The disclosure of the PHP vulnerability prompted government agencies, financial institutions and website operators worldwide to strengthen their security measures. Following reports that artificial intelligence (AI) had helped identify the flaw, security patches were issued to prevent potential data theft and unauthorised access.
PHP is a programming technology widely used in website development. If attackers exploit vulnerabilities in PHP based websites, they could steal sensitive data or gain unauthorised access to systems. Developers have issued security updates and urged users to patch their systems immediately.
Reports also emerged that the US National Security Agency (NSA) had advised organisations using PHP to take their systems offline if they could not install security patches immediately. The UK's National Cyber Security Centre urged organisations to conduct security checks and look for potential backdoors that hackers might have created to gain unauthorised access.
Security agencies in the European Union and Australia also urged organisations to protect government data and systems. Reports from Japan likewise called attention to checking whether public websites used PHP technology.
Cybersecurity agencies have advised organisations to conduct regular system tests even after installing security patches and to monitor future software updates. They have also warned against fake messages and phishing attempts that exploit security alerts to trick users into revealing sensitive information.
In Nepal, authorities are continuing efforts to complete security updates and restore government services. Although most government portals are operational again, disruptions to some public and financial services are likely to continue until Nepal Rastra Bank, the Medical Education Commission, Nagarik App and other affected systems fully resume operations.