Cybersecurity: How Were Threats from PHP Vulnerabilities on Government Websites Mitigated, and What Risks Remain?
Following a serious security vulnerability detected in the PHP programming technology, several government and banking websites that were temporarily taken offline have been gradually restored, officials have confirmed. PHP is a technology commonly used for developing web applications. According to authorities, by applying necessary security patches and completing thorough testing procedures, online services have steadily returned to normal operations. “Over nine hundred websites have been reinstated. We are currently focusing on critical systems such as the Public Service Commission, Passport Department, and the Department of Transport,” stated Subhash Dhakal, acting head of the Office of the Prime Minister and Council of Ministers’ Information Technology and Electronic Governance Division. He added that websites considered high-risk were prioritized in the remediation efforts. “Most websites are expected to be back up by Monday and Tuesday.”
The Information Technology and Electronic Governance Office was established as a replacement for the old Information Technology Department. To address the current challenge, this office is coordinating with the National Cyber Security Center, the Software Development and Operation Center, and other related agencies, Dhakal explained. Security patches and testing were undertaken during the Dashain holiday period. “Having identified the risks, we have adopted advance warnings and precautions. Therefore, there is no need for undue alarm,” he reassured.
These PHP-related security issues have affected many systems not only in Nepal but worldwide. As a precaution against potential cyberattacks, dozens of government websites and systems, including banking platforms, were temporarily shut down in Nepal. Cybersecurity experts warned that attackers could exploit these weaknesses to run server-side code without actually accessing the websites directly. “This is the ultimate target of the hackers,” said cybersecurity expert Santosh Sharma. However, Dhakal from the IT and Electronic Governance Office stated that the risk to the websites themselves was not significant. “The greater risk lies in what damage could occur if attackers penetrate deeper into our systems from these websites,” he explained.
Experts have noted that as reliance on cyber and digital services grows, cyber security challenges are becoming increasingly complex. With the expansion of government services, financial transactions, communication services, and the digital storage of personal data, threats such as cyberattacks, data theft, unauthorized access, and ransomware demands have also increased. According to acting head Dhakal, a risk assessment is underway for critical IT infrastructure to develop a dedicated plan for ‘Critical Information Infrastructure’ (CII). “This work goes beyond the PHP issue and relates to a broader evaluation and management of risk,” Dhakal emphasized.
