Nepal UK
Many of Nepal's government websites were unreachable on Thursday morning after the release of an urgent security fix for PHP, the programming language behind a large share of the web. Sites run by the Office of the President, the Office of the Prime Minister, ministries and municipalities were not opening, according to a report published on 22 October. No Nepali agency had issued a statement at the time of that report.
The problem is global. PHP's developers published fixes on Wednesday 21 October for critical vulnerabilities and urged everyone to update immediately. The cybersecurity firm Wiz says it found the flaws using artificial intelligence, working with the PHP team and the AI developers involved. Technology firms have warned that some attackers were already exploiting the weaknesses. One of the flaws is reported to have gone unnoticed for more than a decade.
Why governments pulled the plug
Rather than risk exploitation, authorities in several countries took services offline until they could be patched. The Dutch national cyber security centre took its own site down, Finland removed public network services as a precaution, and France placed its Interior Ministry's websites under preventive maintenance. Cybersecurity agencies in Europe, Australia, Japan and Britain urged administrators to update or disconnect. One report says the City of Edinburgh Council and the BBC took some pages offline, though that was not independently confirmed here. The same report says the US National Security Agency warned that the flaws could give attackers direct access to a server's files or database.
PHP runs roughly three-quarters of websites whose language can be identified, according to the web-survey firm W3Techs, which is why researchers describe the exposure as affecting most of the internet. Smaller sites on shared hosting may be slower to patch, and so stay vulnerable longer.
What it means for Nepali readers
Nepal's outage looks like a precaution, not a confirmed breach; nothing published so far says data was taken. That distinction matters, and the government has not yet said whether the sites were deliberately taken down. Even so, the episode is a reminder of how heavily citizens, businesses and the diaspora rely on official portals for passports, company registration, tax filings and notices at a time of flood recovery.
Three practical points follow, and they are NepalUK's analysis rather than official advice. First, expect phishing: criminals commonly exploit moments when official sites vanish, so treat unexpected messages about "restored access" or payments with caution. Second, check embassy and ministry social-media accounts for verified updates rather than third-party mirror sites. Third, businesses and community organisations that run their own PHP-based websites, a common set-up for websites built on popular content-management systems, should apply the update immediately or ask their web host to confirm it has done so.
The episode also illustrates a wider shift. AI tools are now finding long-hidden software flaws faster than many organisations can patch them, which favours defenders when disclosure is co-ordinated and attackers when it is not. For Nepal's growing technology sector, security-patching capacity is becoming as important as digital ambition.
It remains unclear when Nepal's sites will return, whether any were compromised, and which agencies were affected beyond those named in reports. Latest verified update: 22 October 2026.
