Nepal takes government websites offline over critical PHP vulnerabilities — Kathmandu Post
The Nepalese government has temporarily taken government online systems offline due to two critical vulnerabilities in the PHP programming language. Emergency security work began on the evening of October 21 after information about these issues was disclosed, the Kathmandu Post reports.
The Software Development and Operation Center, which operates under Nepal's Office of the Prime Minister and Council of Ministers, formed an emergency group together with other technical centers and government representatives. The group decided to take government systems offline as a precaution against possible breaches. Some systems have already been updated and returned to operation.
Vulnerabilities with a critical severity level
The vulnerabilities were assigned the identifiers CVE-2026-109618 and CVE-2026-109619. Both received a score of 9.2 out of 10 under the CVSS version 4.0 system. Under certain conditions, an attacker can send a specially crafted request and remotely execute malicious code on a vulnerable server without logging in or using a password.
More current news is available on the UA.News Telegram channel Telegram.
In the event of successful exploitation, attackers could potentially gain access to confidential information, alter website content, or compromise a system for further attacks. At the same time, the recommendation from Nepal's National Cyber Security Center does not confirm that Nepalese websites have already been breached.
Updates for PHP and popular platforms
On October 22, the National Cyber Security Center urged organizations to check their installed PHP versions and update to patched releases. The warning concerns not only websites that use PHP directly, but also the WordPress, Joomla, Drupal, and Magento platforms.
The center recommended installing PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35, or later versions in the relevant branches. The recommendation contains no necessary fixes for PHP 8.1 and older versions, so they are advised to be replaced with newer secure versions. Organizations that cannot install updates immediately were advised to restrict public access to vulnerable services or isolate them from the internet.
