Kathmandu, 23 October 2026 - Nepal's Department of Revenue Investigation has temporarily shut down the Vehicle Consignment Tracking System (VCTS) after the National Cyber Security Centre flagged a serious vulnerability in the PHP technology used by the platform. The department acted on an urgent cyber security advisory, pulling the tracking system offline as a precaution. Until the system is restored, freight vehicles operating under the consignment tracking requirement must now carry the required bills and documents with them while on the road.
The decision, reported from Kathmandu on Friday, marks an abrupt but decisive response to a security warning at a time when revenue and customs-related processes in Nepal increasingly depend on digital infrastructure. With the tracking system unavailable, the burden of proving what a vehicle is carrying has shifted overnight from a centralised electronic platform to paperwork carried in the driver's cabin.
An urgent advisory prompts a swift suspension
According to reports from Nepal Press, the shutdown followed an urgent advisory issued after the National Cyber Security Centre identified the flaw in the PHP technology on which the VCTS runs. The Department of Revenue Investigation, which operates the system, responded by temporarily closing it rather than risk continued exposure while the vulnerability remains unaddressed.
The advisory-driven nature of the suspension is significant. Rather than waiting for an incident or a breach to occur, the authorities moved to shut the system down as soon as the warning was received, framing the move as a cyber security risk measure. RatoPati likewise reported that the system was closed temporarily specifically because of cybersecurity risks.
The technology at the centre of the alert
PHP is one of the most widely used server-side technologies for building web applications, which means that flaws discovered in it can have consequences far beyond any single platform. When a serious weakness is identified in a technology underpinning a live government system, security agencies can issue urgent advisories so that operators can act before the flaw is exploited. That is the sequence that played out here: the National Cyber Security Centre flagged the issue, and the Department of Revenue Investigation acted on it the same day it was reported publicly.
The reports did not detail the technical specifics of the vulnerability, nor whether any exploitation had actually occurred. What they make clear is that the warning was treated as serious enough to justify suspending a nationwide tracking facility outright.
Back to paperwork on the highway
The most immediate consequence falls on freight operators. With the Vehicle Consignment Tracking System offline, vehicles carrying goods must now travel with the bills and documents required for their consignments. In practical terms, the physical paperwork carried by drivers stands in for the digital record that the tracking system normally maintains, and any checking of goods in transit will rely on those documents being present with the vehicle.
RatoPati's reporting framed the new arrangement bluntly: truck drivers must carry their bills with them, consignment by consignment, for as long as the system remains closed. For transporters accustomed to relying on the electronic platform, the change reintroduces a familiar older routine of physical documentation on the highway.
What transporters should do now
Based on the arrangements reported so far, operators and drivers should keep the following in mind while the suspension lasts:
- Carry all bills and consignment documents with the vehicle whenever it is operating, as the tracking system cannot currently be used to verify cargo.
- Treat the physical paperwork as the primary reference for the goods being transported until further notice.
- Follow updates from the Department of Revenue Investigation on the status of the system, since the department has described the shutdown as temporary.
The requirement applies to freight vehicles covered by the consignment tracking regime, meaning that any goods movement previously recorded through the VCTS now needs to be supported by documents carried on board.
A temporary shutdown, with restoration expected
The department has characterised the measure as temporary, and neither the advisory process nor the shutdown suggests a permanent decommissioning of the platform. The available reports did not specify how long the suspension will remain in place or when the system is expected to return to service. What they do indicate is that the Department of Revenue Investigation judged the security risk flagged by the National Cyber Security Centre to be serious enough that continued operation was not an acceptable option in the short term.
Global Aawaj also reported on the closure, underscoring the breadth of coverage the suspension received across Nepali media on the day it was announced.
The episode illustrates how quickly an urgent cyber security advisory can translate into operational change on the ground. Within the space of a single announcement, verification of consignments has moved from a central digital system to paper documents travelling with each truck. It also highlights the growing dependence of revenue administration on online platforms, and the corresponding weight that national cyber security monitoring now carries in day-to-day governance.
For now, the instruction to the freight sector is simple: no vehicle should move goods without its bills and documents on board, until the Vehicle Consignment Tracking System is back online.
