The Department of Revenue Investigation, a Nepal government body that controls and investigates revenue leakage, has temporarily shut down the Vehicle Consignment Tracking System (VCTS) after the National Cyber Security Centre identified a critical security vulnerability in the PHP technology used by the system.
The Centre warned that the vulnerability, dubbed ‘PHP@Shell’ (CVE-2026-109618 and CVE-2026-109619), could allow hackers to execute code directly on the server without login credentials and take control of the system. This closure means that drivers and businesses transporting goods must now carry physical bills and other necessary documents.
Critical ‘PHP@Shell’ Vulnerability and its Impact
The National Cyber Security Centre, a government institution under the Office of the Prime Minister and Council of Ministers, discovered the ‘PHP@Shell’ vulnerability with a high severity score of 9.2 on the Common Vulnerability Scoring System (CVSS). This flaw significantly increases the risk of hackers directly executing code on servers and gaining control of systems. The Centre has urged both government and private sector entities to implement immediate security updates.
In response to this ‘urgent cyber security advisory’, the Department of Revenue Investigation closed the VCTS. This follows similar actions by other institutions; earlier, Nepal Rastra Bank, the central bank, and most commercial banks temporarily suspended their websites and various web-based services due to the same security flaw. Global IME Bank, for instance, temporarily closed its digital universe services on Friday, October 23, 2026, which included ATM card replacement, online check clearing, and cash deposit machine-related services.
The Software Development and Operation Centre (SDOC), another body under the Office of the Prime Minister and Council of Ministers, also issued an urgent security notice, stating that systems were being shut down as a precautionary measure to secure them and protect data. While some government websites and systems were brought back online on Thursday, October 22, 2026, after security improvements, it remains unclear when the VCTS will resume operations.
VCTS Objectives and Next Steps
The Vehicle Consignment Tracking System (VCTS) was implemented on Shrawan 1, 2076 (BS), although the law for it was enacted in 2071 (BS) under the Revenue Leakage Control Act 2052. The primary goal of the VCTS is to monitor goods and transport vehicles easily, prevent revenue leakage, and enhance transparency in commercial activities.
The Department of Revenue Investigation announced that services will resume once the necessary security updates are completed and the system is secure. Once the system is back online, relevant service users, taxpayers, and entities will be required to enter consignment details into the VCTS as per regulations. The Department has apologised for the inconvenience caused to service users and other stakeholders, seeking their cooperation and coordination in this step taken to ensure system security.
To mitigate risks, the National Cyber Security Centre recommended on Friday, October 23, 2026, that all PHP versions in use be immediately updated to 8.2.35 or higher, 8.3.36 or higher, 8.4.27 or higher, and 8.5.12 or higher. Banks and financial institutions are also working to secure their systems and implement necessary technical improvements.
Nepal’s cyber security landscape has been a growing concern. The National Cyber Security Centre was established as per the decision of the Council of Ministers on Magh 9, 2080 (BS), with the aim of fulfilling the aspirations of the ‘Digital Nepal Framework 2076’. Nepal’s Cyber Security Policy 2080 has also been approved by the Council of Ministers. However, a weak cyber security system, lack of legal enforcement, and low digital literacy continue to fuel cybercrimes in Nepal. The vulnerability found in the VCTS highlights the urgent need for increased attention to the security of government systems. Closed government websites and services will be gradually brought back online once testing is complete and they are fully secure.
For more details on the broader impact of this vulnerability, read our earlier coverage: Global cyberattack attempts surge after PHP vulnerabilities, Nepali banks on alert.
