Government websites in Nepal and several other countries were offline on Thursday morning, October 22, after researchers using artificial intelligence (AI) identified two serious vulnerabilities in PHP, the widely used programming language, according to reports from Kathmandu. Cybersecurity agencies urged organisations to install newly released security updates immediately or temporarily shut down affected websites if they could not apply the fixes.
Security flaws trigger urgent warning
The discovery has prompted a rapid response because the vulnerabilities affect PHP, a programming language used to build and operate websites. The reports describe the flaws as serious and say that cybersecurity agencies advised organisations not to leave systems unaddressed: the immediate recommendation was to apply the available security update, or keep websites offline until that could be done.
The update is intended to fix both vulnerabilities. Organisations responsible for PHP-based websites therefore face a direct choice between installing the security fixes and temporarily interrupting public access. The advice to shut websites down is a precaution for organisations unable to update promptly, rather than a claim that every PHP website has been compromised.
The reports did not establish that attackers had exploited the flaws or that data had been taken from affected sites. They did, however, describe the vulnerabilities as serious and convey an urgent call to act. For website operators, the immediate task is to determine whether their systems require the update and apply it without delay. If they cannot do so, agencies have recommended keeping the relevant websites offline in the meantime.
Government websites affected, including in Nepal
Government websites in multiple countries have gone offline following the warnings. Nepal is among the countries affected, with Nepali government websites remaining closed as of Thursday morning. The shutdowns have made government web services unavailable to visitors while the security issue is being addressed.
A website being offline does not, by itself, show whether its operators have installed the update, are preparing to do so or have chosen a temporary shutdown as a protective measure. The reports say that websites were taken offline and that agencies advised temporary closure where updates could not be applied, but do not give a complete account of the status of individual sites. They also do not identify which Nepali government websites were affected or when access would be restored.
The situation places attention on the practical steps behind an emergency security response: identifying websites that use the affected software, applying the available fix and deciding whether public access can safely resume. Until operators have addressed the vulnerabilities, temporary unavailability may continue. The advice to keep sites closed where updates cannot be installed reflects the priority given to reducing exposure while the issue is being handled.
Update released as organisations assess systems
A security update that fixes the two PHP flaws has been released. Cybersecurity agencies are urging organisations to use it immediately. For operators that cannot apply the update at once, the recommended alternative is to keep their websites shut down temporarily rather than leave them accessible without the fix.
That guidance applies to organisations responsible for affected websites, including public institutions. The release of a fix gives operators a concrete step to address the vulnerabilities, but the reports do not indicate how quickly individual organisations can complete the work. They also do not provide a timeline for restoring the Nepali government websites that remained offline on Thursday morning.
The discovery has put the security of websites built with PHP under immediate scrutiny and has led to visible service interruptions across countries. For users in Nepal, the clearest impact so far is that government websites remained inaccessible. Their return will depend on the actions taken by the organisations operating them, while the wider warning remains straightforward: install the security update, or keep sites offline until it can be applied. Read more about the PHP vulnerabilities.
