Nepal UK
Nepali government bodies and financial institutions took websites offline on 22–23 October as a precaution against two critical flaws in PHP, the programming language behind a large share of the web. The flaws, CVE-2026-109618 and CVE-2026-109619, were disclosed on 21 October and rated 9.2 out of 10 under CVSS v4.0. According to the PHP project's advisory, they could allow remote code execution without a login under certain conditions.
Nepal's Software Development and Operation Centre, which sits under the Office of the Prime Minister and Council of Ministers, formed an emergency team on the evening of 21 October and took systems offline as a precaution. Some have since been patched and restored. The National Cyber Security Centre issued an urgent advisory on 22 October but said it did not establish that any Nepali website had been successfully attacked.
On 23 October Nepal Rastra Bank told banks, payment operators and remittance companies to tighten security and, where necessary, take websites offline. Spokesperson Guru Prasad Paudel said a website being offline "does not mean it has been hacked". The Nepal Bankers' Association said mobile banking and QR payments were operating normally; disruption was mainly to internet banking and website services. No remittance disruption has been reported.
Patches are available in PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35. PHP 8.1 and earlier receive no regular fixes. Nepali businesses, charities and community organisations in the UK that run WordPress, Joomla, Drupal or Magento sites should confirm their PHP version with their hosting provider. Unconfirmed: which systems remain offline in Nepal, and whether any site has been compromised. Latest verified update: 23 October 2026.
