Nepal Rastra Bank Issues Cyber Alert as Critical PHP Vulnerabilities Prompt Preventive Shutdowns

Nepali banks, financial institutions, and major government agencies—including the Employees Provident Fund and the Social Security Fund—have temporarily taken their websites offline as a precautionary measure following the discovery of critical security vulnerabilities in PHP, a server-side programming language widely used to power online platforms. In a formal notice issued on Friday, Nepal Rastra Bank (NRB), the country’s central bank, urged financial institutions, payment operators, and remittance companies to strengthen their cyber defenses, adopt official security advisories, and temporarily disconnect vulnerable systems from the internet where immediate patching is not possible. Guru Prasad Paudel, spokesperson for Nepal Rastra Bank, explained that the system weaknesses were uncovered when security researchers utilized artificial intelligence models to analyze and stress-test underlying PHP code. Because these flaws could allow unauthorized external access to primary servers, institutions followed international protocols—including recent directives from the US National Security Agency—to mitigate the risk of cyberattacks. NRB and industry leaders emphasized that taking a website offline is a standard preventive safeguard rather than evidence of a security breach or system compromise, confirming that no customer data or financial assets have been lost. While the temporary shutdowns disrupt public access to routine online services, interest rate notices, branch locators, loan applications, and website-hosted internet banking, core daily operations remain functional. Santosh Koirala, president of the Nepal Bankers’ Association, clarified that mobile banking and QR code payment networks continue to operate normally without interruption, adding that several institutions have already restored their websites after applying necessary security updates and completing risk assessments. Experts note that these PHP vulnerabilities are not restricted to older software versions or isolated to Nepal, affecting web infrastructure globally and requiring routine, heightened monitoring across all digital networks. By taking aggressive, early action to isolate vulnerable systems, Nepal’s financial sector aims to patch critical infrastructure, update server code, and contain potential cyber threats while minimizing operational disruption for the public.