The National Cyber Security Centre (SCSC), a body under the Office of the Prime Minister and Council of Ministers, has issued a new cyber security advisory to website and online system operators following the discovery of critical security vulnerabilities in PHP software. The advisory suggests various measures to mitigate the serious risks identified in websites.
This advisory follows the temporary shutdown of government websites in Nepal due to severe cyber security flaws found in the PHP programming language, which affected the delivery of government services.
PHP Vulnerabilities and Affected Systems
According to the SCSC, critical security vulnerabilities have been found in the PHP software used in web systems. These flaws expose websites and online systems to potential risks of hacking and data theft.
The advisory targets websites and online systems that use PHP and related systems such as Apache, PHP-FPM, and LiteSpeed web servers, as well as Content Management Systems (CMS) like WordPress, Joomla, Drupal, and Magento.
SCSC Recommendations for Risk Mitigation
To guard against cyber security risks, the National Cyber Security Centre has provided several recommendations for website operators. These suggestions aim to strengthen system security and protect against potential attacks:
- Upgrade Systems: Operators should upgrade their PHP and related software to the latest versions.
- Replace Old Versions: If any system is using old and insecure versions of PHP, they should be immediately replaced with secure versions.
- Resume Services Safely: Websites and online services should only be reactivated after security vulnerabilities have been resolved.
- Isolate Systems if Immediate Fix is Not Possible: If immediate resolution of security vulnerabilities is not possible, the SCSC advises isolating such systems from the network to prevent the risk from spreading to other systems.
Decrease in Cybercrime Complaints, Facebook Remains Key Medium
While the National Cyber Security Centre issues its advisory, overall cybercrime complaints in Nepal decreased. In the fiscal year 2081/82, a total of 18,926 cybercrime-related complaints were received, marking a 4 percent reduction compared to the previous year.
However, 51.93 percent of cybercrime incidents originated from Facebook. Among the victims, 51.7 percent were men and 41.9 percent were women. Furthermore, out of 223 total victims, 82.1 percent were women and 7.65 percent were girls.
In the fiscal year 2081/82, 218 cybercrime cases were registered nationwide, with 112 of them filed at the Cyber Bureau. Out of 392 perpetrators, 83.9 percent were men.
Relevance of Cyber Security in Madhesh Province
The SCSC’s advisory is relevant for website operators across the country. Although specific information on the cyber security situation in Madhesh Province is not available, the advisory is equally relevant for government and private websites in the province, as they also use PHP-based systems.
The SCSC plans to conduct cyber security programs for all three levels of government in the current fiscal year. This includes awareness-raising programs at the community level through collaboration with federal, provincial, and local governments. Awareness programs will also target senior citizens, women and children, individuals with special needs, and civil society.
Cyber Security Network and Future Programs
The National Cyber Security Centre has already sent letters to various ministries, constitutional bodies, commissions, and offices to establish a national network of cyber security focal persons. This network is expected to be formed and operational soon.
The SCSC will continue to issue advisories as needed to inform citizens about public interest issues and incidents related to cyber security. For background, refer to our earlier coverage: PHP security flaws temporarily shut down Nepal government websites.
