Nepal Government Websites Offline
Nepal has taken most of its government websites offline after two critical security flaws were discovered in PHP, the programming language that powers a large share of the world’s websites. According to Daily Informiq, the flaws allow remote code execution and carry a CVSS severity score of 9.2, placing them among the most dangerous categories of software vulnerability. The affected portals include the websites of the President’s Office, the Prime Minister’s Office, federal ministries, and local governments.
The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, were disclosed alongside emergency PHP patches released on October 21, 2026, covering versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35. Raj Kumar Maharjan, spokesperson for Nepal’s Cyber Security Centre, told Daily Informiq that pulling the sites offline was a precautionary step while patches are applied and systems are checked for signs of intrusion. The report, datelined Kathmandu, was published on October 22, 2026.
The incident reaches far beyond Nepal. Reuters reported that government websites went dark after the AI-discovered flaw sparked a security scramble, while the BBC said websites were taken down worldwide as the critical PHP security update was issued. Sky News and The Kathmandu Post also covered the story, and CERT-EU published an advisory on October 20, 2026. The synchronized global response shows how a single widely used software component can create simultaneous risk across continents.
For Nepal’s construction sector, the outage is a reminder of how dependent the industry has become on digital government services. Contractor licensing, permit applications, tender notices, and public procurement portals all run through the same government web infrastructure. When those portals go dark, even briefly, bidding schedules and approval timelines can slip, adding uncertainty to project planning.
Security specialists say the episode underlines the importance of keeping server software current and monitoring for unusual activity after patching. Remote code execution flaws are prized by attackers because they can let an outsider run commands on a server without valid credentials. Until every affected system is patched and verified clean, keeping the sites offline remains the safer course, a trade-off between availability and security that governments everywhere are now weighing.
The speed of the response reflects how seriously the flaws are being taken. Emergency patches for four supported PHP branches at once are unusual, and the decision by multiple governments to take public-facing sites offline rather than risk exploitation shows the severity of the threat. For site owners, the lesson is plain: inventory where PHP runs in your stack, apply the October 21 patches without delay, and watch logs for exploitation attempts in the window before patching.
Source: Daily Informiq
Follow Nepal government websites offline updates and more Nepal infrastructure news on Eve Construction, where we track the stories shaping the country’s build environment.