Nepal government websites temporarily shut down due to global PHP security flaw

Nepal’s government websites, including those for President Ramchandra Paudel, Prime Minister Balen Shah, various ministries, and local municipalities under the .gov.np domain, remained inaccessible on Thursday morning after a critical cybersecurity flaw was discovered in the widely used PHP programming language.The issue is part of a global problem, with several countries and organizations temporarily taking their online services offline to address the vulnerability. Cybersecurity research firms Calife and Wiz, using artificial intelligence (AI) tools, identified these weaknesses, which reportedly went undetected for over a decade.Wiz estimates that approximately 70 percent of websites globally could be affected, though this figure has not been independently verified. The United States’ National Security Agency (NSA) has urged organizations unable to implement security updates promptly to take their systems offline to prevent unauthorized access to server file systems or databases.In response to the vulnerability, the Finnish government has temporarily closed its public web services, and the Netherlands’ cybersecurity agency has also taken its website offline. The Edinburgh City Council in the United Kingdom and the Wikimedia Foundation, which operates Wikipedia, have also shut down some of their systems.The risk associated with these security flaws escalated after details were publicly disclosed on social media on Tuesday. Authorities worldwide are urging affected organizations to apply security updates and take necessary precautions.Nepal has been working to enhance its cybersecurity infrastructure. The government passed the Cybersecurity Policy, 2080, and established the National Cybersecurity Center. This center is tasked with research and development, promotion, preparedness, prevention, identification, response, and recovery related to cybersecurity, operating as a 24/7 contact point.This is not the first time Nepal’s government websites have faced significant cyber threats. Last year, more than 400 government websites were shut down due to a Distributed Denial of Service (DDoS) cyberattack on the central data center. In September 2026, a ransomware attack on the Nepal Stock Exchange (NEPSE) data hub paralyzed the trading systems of 72 broker companies for an entire day.The current shutdown directly impacts the delivery of government services. However, it remains unclear how long Nepal’s government websites will remain offline.