- Nepal disabled major government websites, including the President's office, to address two critical PHP security vulnerabilities discovered Wednesday.
- The high-severity flaws allow unauthenticated attackers to remotely execute code, threatening sensitive databases and administrative systems globally.
- International agencies, including the US NSA, issued urgent warnings as countries like Finland and the UK also suspended services.
- Nepali authorities are currently auditing IT infrastructure to confirm software updates are successfully deployed before restoring full online access.
Kathmandu, Nepal: Nepal’s government was forced to pull major public websites offline Thursday morning following the discovery of two critical security flaws in PHP, the coding language powering much of the internet.
Services for the Office of the President, the Office of the Prime Minister, multiple ministries, and local government portals were unreachable as IT teams rushed to secure their servers. Official agencies have not confirmed whether any data was compromised or if the downtime was strictly a precautionary measure.
The emergency was triggered Wednesday when PHP developers released security patches for two vulnerabilities, each rated a 9.2 out of 10 in severity. The flaws allow unauthenticated attackers to remotely execute code on vulnerable web servers, potentially granting access to sensitive databases, administrative controls, and system files.
Because PHP runs platforms such as WordPress and underpins a vast portion of public websites, the security alert triggered rapid shutdowns globally:
Finland temporarily pulled several public web services offline.
The Netherlands planned a temporary shutdown of its national cybersecurity agency’s site to apply fixes.
The UK saw web pages managed by the BBC and the Edinburgh Council taken down.
The U.S. National Security Agency (NSA) explicitly warned organizations to take unpatched systems offline immediately rather than risk exposure.
The security flaws were first detected through AI-assisted research analyzing PHP's underlying source code. While automated tools helped spot the vulnerabilities quickly, cybersecurity officials stressed that protection depends on how fast individual organizations can deploy the software updates.
Nepali authorities are continuing to audit state IT infrastructure to confirm server updates before bringing public services back online.
