PHP Security Vulnerability Disrupts Nepal’s Banking Sector, Forcing Websites and Online Services Offline
Kathmandu – Nepal Rastra Bank and several commercial banks have temporarily shut down their websites and some web-based services after a serious vulnerability was identified in PHP, a programming language widely used to run websites and online systems. The shutdowns are a precaution against possible cyberattacks.
The National Cyber Security Centre had earlier issued an emergency advisory urging government agencies, public service providers and website operators to assess their systems immediately. It warned that systems running various PHP runtimes and web technologies could be exposed, including Apache, mod_php, PHP-FPM, PHP-CGI, FrankenPHP and LiteSpeed, as well as platforms such as WordPress and Drupal. Attackers could exploit the flaw to gain unauthorized access or carry out other attacks. The centre advised organizations to upgrade their PHP versions, apply security patches and fix vulnerabilities in outdated software. Where immediate updates were not possible, it recommended isolating vulnerable systems from the public internet and suspending the affected services.
Nepal Rastra Bank has taken its official website and other web-based services offline. It has also directed banks, financial institutions, payment system operators, payment service providers and remittance companies to strengthen system security and increase routine monitoring.
Banks have since begun security assessments, technical upgrades and measures to prevent unauthorized access, and the scope of disruption differs by institution depending on each bank’s systems and risk exposure. Global IME Bank suspended its Digital Universe service for security and maintenance, affecting ATM card replacement, online cheque clearing and cash deposit machines, though the bank said its other services remain operational. Nabil Bank reported disruptions to its NBank microsite, GenAlpha app, online debit and credit card requests, and fixed-deposit-backed loan services. Prime Commercial Bank shut down its online account-opening portal, online fixed-deposit service, customer portal, online account-blocking service and balance-certificate verification portal.
NIC Asia Bank took its official website and other web services offline as part of its risk assessment, while Siddhartha Bank suspended its official website and the online services available through it. Machhapuchchhre Bank took its website and selected web services offline to update PHP-based systems, and Nepal Investment Mega Bank shut down its official website for security maintenance and upgrades. Some banks say their core banking and mobile banking services remain available. However, the impact is uneven across institutions, and it has not been confirmed that every suspended service has resumed.
PHP-based technologies can support banking services, online applications, customer information management and public information systems, so a serious vulnerability can affect more than a site’s public-facing pages. If exploited, such flaws could let attackers gain unauthorized access, run malicious commands on servers or disrupt websites and connected services. The actual risk depends on the software version, system configuration and existing security measures.
Reports on the issue have also noted that artificial intelligence helped identify some vulnerabilities that had stayed hidden in code for long periods. Once a flaw becomes public, attempts to exploit it tend to increase, which makes monitoring and patching outdated systems especially important.