Nepal Rastra Bank and Siddhartha Bank have temporarily shut down their websites and other online services, citing a serious security risk in PHP, the web technology at the centre of a vulnerability that is currently being seen across the world. The central bank announced the temporary closure through a notice issued on Friday, while Siddhartha Bank separately informed the public that its official website and other online services had been taken down for the same reason. Both banks said the suspension was a precautionary measure against the global PHP security vulnerability.
Key points at a glance
- Nepal Rastra Bank, the country's central bank, has temporarily closed its official website and other online services.
- Siddhartha Bank has also temporarily shut down its official website and other online services.
- The stated reason in both cases is a serious security vulnerability in PHP, a risk that is being seen globally.
- Both banks describe the move as temporary and precautionary, with no timeline yet announced for services to resume.
Nepal Rastra Bank suspends its website and online services
Nepal Rastra Bank said in a notice issued on Friday that it was temporarily shutting down its website along with other services. According to the notice, the decision was taken in view of a serious security risk detected in PHP, the technology used to build and operate websites, which is currently posing a threat worldwide. The bank said the services were being suspended as a precaution against the global vulnerability.
As reported by Rato Pati, the closure covers the central bank's website and other online services and has been described as temporary. Global Aawaj also covered the suspension, which was communicated to the public through the bank's official notice. The central bank, which regulates and supervises Nepal's banking system, did not announce how long the suspension would remain in place.
Siddhartha Bank takes its platforms offline too
Siddhartha Bank, meanwhile, issued its own notice announcing that its official website and other online services had been temporarily closed. The bank cited the same cause as the central bank: a serious security risk in PHP that is being seen globally. Nepal Press reported that the bank's website and other online services are down because of the security concern.
Like Nepal Rastra Bank, Siddhartha Bank said the suspension of its services was a precautionary step aimed at guarding against the global PHP security vulnerability. The bank also did not specify when its website and online platforms would be restored.
The PHP security risk behind the shutdowns
PHP is a widely used web technology that powers websites and web applications around the world, including those operated by banks and other financial institutions. When a serious security flaw emerges in such a widely deployed technology, the potential exposure is broad, because a large number of systems built on the same software can be affected at once. That global reach is what appears to have prompted the two Nepali banks to act.
According to the notices cited in local media reports, both institutions identified the PHP vulnerability as a serious risk being seen globally. Neither notice detailed the technical specifics of the flaw, nor did either indicate that the bank concerned had suffered a security breach. Instead, both framed the shutdown of websites and online services as a safeguard taken in response to the global risk.
The near-identical language used by the two institutions, with each pointing to the same global vulnerability and describing its own action as precautionary, indicates that the decisions were driven by the same underlying concern rather than by separate incidents. For a sector that depends heavily on web-based platforms for customer-facing services, the choice to suspend those platforms outright reflects the seriousness with which the PHP risk is being treated.
What happens next for customers
For now, anyone attempting to access either bank's website will find the services unavailable. The suspension extends beyond the main websites to the other online services named in the notices, although the banks have not detailed which specific platforms are covered.
Neither bank has announced when normal operations will resume. Both have described the shutdowns as temporary, and the precautionary framing of the notices indicates the services are intended to come back online once the risk linked to PHP is addressed. Until then, customers will need to watch for fresh announcements from the two institutions.
The parallel action by the central bank and a commercial bank offers a clear illustration of how a single vulnerability in a globally used web technology can ripple through the financial sector, prompting institutions in Nepal to pull their public-facing online services offline rather than leave them exposed. Further updates on the restoration of the websites and online services are expected to come through new notices from Nepal Rastra Bank and Siddhartha Bank.
