Global cyberattack attempts have surged following the public disclosure of critical security flaws in the PHP programming language, prompting cloud service providers to report millions of hacking attempts. In response to this global threat, banks and financial institutions in Nepal are on high alert.
Two severe remote-code-execution vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, were discovered in PHP, a widely used programming language for internet websites. These flaws, collectively named PHP2Shell, have a CVSS v4.0 rating of 9.2. The vulnerabilities were identified with the assistance of artificial intelligence (AI) tools.
Emergency updates and government response
Information about these vulnerabilities was publicly disclosed on the Hacker News discussion forum on October 20, 2026, leading PHP developers to issue an emergency security update on October 21, 2026. Users have been urged to immediately upgrade their systems.
The Nepali government temporarily shut down its online systems from the evening of October 21. Some systems have since been brought back online after applying necessary security patches. Nepal’s National Cyber Security Centre issued an urgent advisory on October 22, instructing organizations to check their PHP installations and upgrade to patched versions.
Financial sector vigilance and past losses
Nepal Rastra Bank, the central bank and financial sector regulator, has mandated that financial institutions adhere to cybersecurity guidelines and conduct third-party audits. This measure is expected to help banks and financial institutions prevent future cyberattacks. In the fiscal year 2024-25, Nepal experienced a total loss of Rs 1.79 billion due to cyber-enabled financial fraud.
The Cyber Bureau of Nepal Police registered 20,526 cybercrime complaints in the fiscal year 2082/83 (mid-July 2025 to mid-July 2026), resulting in 161 registered cases and 155 arrests. In the fiscal year 2081/82, 18,926 complaints were registered, and in 2080/81, there were 19,730 complaints.
Potential impact and future outlook
The PHP vulnerabilities could also affect Madhesh Province and the Terai region, as many Nepali websites run on PHP. These include government portals, internet service provider client sites, e-commerce storefronts, and public-facing sites for banks, digital wallets, and remittance companies.
The Nepali government aims to restore all critical systems after applying the necessary security updates to affected platforms. The implementation of the National Cyber Security Policy 2024 will continue through 2026-2028, involving the progressive rollout of specific initiatives. Nepal Rastra Bank has also developed a roadmap for implementing cybersecurity guidelines for licensed banks and financial institutions. The development of a data protection framework is also expected to influence cybersecurity expectations.
It remains unclear how many websites in Nepal have been successfully hacked or how much data has been stolen due to the PHP vulnerabilities. The number of Nepali organizations using outdated PHP versions that cannot receive security updates is also not yet clear, nor are the full long-term consequences of these vulnerabilities.
