Nepal's government has temporarily shut down some of its official websites and online systems after a serious security risk emerged in PHP, the technology on which many of the country's digital platforms run. The Software Development and Operation Center (SDOC), the state body that develops and operates government software under the Office of the Prime Minister and Council of Ministers, announced the precautionary measure in Kathmandu on October 22, 2026. According to the center, the step was taken to prevent possible cyberattacks and the damage they could cause, following the discovery of the "PHP2Shell" vulnerability, which can allow unauthorized code to be executed on government servers.
A precautionary shutdown by the government's software agency
The SDOC occupies a central place in Nepal's digital administration. Working under the Office of the Prime Minister and Council of Ministers, it is the agency responsible for building and running the software and online systems used by government bodies. That position means any weakness in a core technology such as PHP can affect multiple state platforms at the same time.
It was with that risk in mind that the center moved on October 22 to take some government websites and online systems offline. The SDOC described the closures as temporary and framed them as a defensive step. The purpose, it said, was to stop possible cyberattacks before they could take place and to spare government servers the damage that an exploitation of the flaw could cause.
Reports by Nepal Press, Pradeskhabar and News of Nepal all pointed to the same cause: a serious security risk in PHP technology that the center judged too dangerous to leave exposed while the systems remained online.
Key facts at a glance
- What happened: Some government websites and online systems were temporarily shut down on October 22, 2026.
- Who acted: The Software Development and Operation Center (SDOC), under the Office of the Prime Minister and Council of Ministers.
- Why: A serious security risk in PHP technology, linked to the "PHP2Shell" vulnerability.
- The flaws: Two vulnerabilities, CVE-2026-109618 and CVE-2026-109619, each rated CVSS 9.2.
- Stated purpose: Preventing possible cyberattacks and the damage they could cause to servers.
What the PHP2Shell vulnerability does
At the heart of the shutdown is a flaw known as "PHP2Shell." The name describes what makes it dangerous: the ability to move from a PHP application to the execution of unauthorized code on the server that hosts it.
PHP is a server-side programming language used to build websites and web applications, and it is widely deployed across both the public and private sectors. When a flaw of this kind appears, the danger is not limited to a single page or feature. An attacker who successfully exploits a code-execution bug can run their own instructions on the machine that hosts a website, potentially reading, altering or destroying data, interrupting services or seizing control of the system itself.
Because the weakness sits at the server level, it cannot be fixed by simply editing a page or closing a form. The systems remain exposed for as long as they are reachable, which helps explain why the SDOC chose to pull its platforms offline entirely rather than leave them running while the risk was being addressed.
Two flaws rated 9.2 out of 10
The SDOC cited two specific security flaws as the source of the danger. They are catalogued as CVE-2026-109618 and CVE-2026-109619, and both carry a CVSS score of 9.2.
What the scores mean
CVE identifiers are the standard labels used around the world to track publicly known vulnerabilities. They allow software vendors, system administrators and security teams to know precisely which weakness they are dealing with and to coordinate fixes accordingly.
CVSS, the Common Vulnerability Scoring System, grades such flaws on a scale from 0 to 10, taking into account how easily they can be exploited and how much harm they can inflict. A rating of 9.2 falls in the highest band of the scale, the range generally treated as critical. Scores at that level are reserved for flaws considered capable of severe consequences, which is exactly the profile of a vulnerability that permits unauthorized code execution on a server.
What happens next
For members of the public, the immediate effect is interruption. Government websites and online systems covered by the measure are unavailable for the time being, and users seeking public services may have to wait until the platforms come back.
The SDOC has characterized the closures as temporary, indicating that the websites and online systems are expected to return once the security risk from the PHP flaw is brought under control. Until then, the offline status of the platforms acts as a shield: a server that cannot be reached over the internet is a server that cannot be attacked through this vulnerability.
The episode is also a reminder of how dependent modern administration has become on a small set of web technologies, and how a single flaw in one of them can force a government to switch off parts of its own digital infrastructure, if only briefly, to keep attackers out.
