- Two high-severity PHP vulnerabilities allowing unauthenticated remote code execution have prompted global security alerts and emergency patch releases.
- Nepal’s financial and government sectors proactively took public websites offline to apply security updates and prevent potential exploitation.
- Authorities confirm no evidence of compromised data or stolen funds, stating the service blackouts are purely precautionary measures.
- Organizations must upgrade to patched PHP versions, such as 8.5.12 or 8.4.27, to resolve critical memory management flaws.
Kathmandu, Nepal: A pair of newly discovered high-severity vulnerabilities in PHP, the server-side programming language powering nearly 70 percent of the web, has sent shockwaves through global IT operations and forced sweeping offline measures across Nepal’s financial and government sectors.
The security flaws, designated CVE-2026-109618 and CVE-2026-109619, allow unauthenticated attackers to execute arbitrary code remotely on unpatched servers. In response to the emergency patches issued by the PHP core development team on October 21, institutions across Nepal—ranging from the central bank to commercial lenders and public-service platforms—have proactively taken public-facing websites and web portals offline to prevent potential exploitation.
Crucially, central bank officials and banking sector leadership confirm there is currently no evidence of compromised customer data, stolen funds, or a successful system intrusion. The widespread service blackouts are entirely precautionary measures designed to buy time for technical teams to apply patches and verify system integrity.
A Critical Global Flaw
The vulnerabilities impact core memory management within PHP, specifically how the language handles out-of-memory errors and post-memory-deallocation states. If exploited, an unauthenticated user could send tailored requests to an exposed server, gaining execution privileges matching the web-server process.
Depending on broader system configurations and network segmentation, an attacker could theoretically tamper with web content, access restricted credentials, or leverage the compromised machine as a pivot into internal networks.
Given PHP’s massive footprint—underpinning content management systems like WordPress, Drupal, and custom web applications worldwide—cybersecurity authorities across Europe and North America issued concurrent advisories urging immediate action. Because proof-of-concept exploit details often surface rapidly following patch releases, the window between patch availability and widespread automated scanning by malicious actors is exceptionally narrow.
Central Bank and Lenders Take Precautionary Measures
To mitigate exposure, Nepal Rastra Bank (NRB) temporarily removed its primary website and several online portals from the public internet. The central bank directed commercial banks, payment service providers, remittance operators, and financial infrastructure vendors to conduct immediate audits and apply the required security updates.
NRB spokesperson Guru Prasad Poudel emphasized that taking these systems offline reflects a proactive risk containment strategy rather than a response to an ongoing breach. While the temporary shutdown of the central bank’s portal created brief information gaps for daily exchange rates and official notices, public communications were temporarily diverted to official social media channels.
Commercial institutions—including Global IME Bank, Siddhartha Bank, and Nabil Bank—similarly restricted access to select web-based facilities. Services such as online account opening, customer verification (KYC) updates, and informational websites experienced planned downtime.
However, core banking operations, mobile applications, and QR-code payment networks remained fully functional. Core transactional systems typically run on isolated infrastructure distinct from public-facing marketing and information websites, meaning daily banking transactions continued without structural disruption. Several banks, including Nabil Bank, completed their patching cycles and restored public web services shortly after verification.
Broader Public Sector Impact
The disruption extended beyond the financial sector into public administration. Key agencies, including the Social Security Fund and the Employees Provident Fund, temporarily pulled web platforms offline following an urgent directive from Nepal’s National Cyber Security Centre.
The advisory urged all public and private entities utilizing PHP-backed infrastructure—including custom deployments and standard web frameworks—to immediately upgrade to stable release branches (specifically PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35).
Containment vs. Resolution
While pulling exposed portals offline prevents immediate remote attacks, security experts stress that temporary shutdowns are merely a stopgap. Complete resolution requires comprehensive asset discovery to identify all embedded PHP dependencies—including those buried within third-party vendor appliances and containerized applications.
Once patches are applied, engineering teams must conduct thorough log reviews to confirm that no unauthorized access occurred prior to the shutdown. Only after patches are verified, server logs audited, and credential stores checked should public connectivity be restored.
The incident highlights the operational vulnerabilities inherent in relying on shared, open-source web technologies. As Nepal’s public and financial services continue to digitize rapidly, the episode serves as a stark reminder that robust patch-management pipelines, strict network isolation, and rapid incident response are as vital to institutional stability as physical security.
