Himalini Desk, Kathmandu, October 25: Two serious security vulnerabilities identified in PHP, a widely used programming language for websites, have prompted organisations in several countries to temporarily shut down their websites or restrict online services as a precaution against potential cyberattacks.

The vulnerabilities have raised concerns among government offices, hospitals, educational institutions and other organisations that rely on PHP-based systems to deliver online services.

The issue has also drawn attention in Nepal. The National Cyber Security Centre, operating under the Office of the Prime Minister and Council of Ministers, issued a cybersecurity advisory on Thursday, urging concerned organisations to update their systems immediately and take necessary measures to reduce potential risks.

According to the advisory, organisations running vulnerable PHP versions should upgrade to the relevant secure releases. Where immediate updates are not possible, they have been advised to temporarily isolate vulnerable services accessible through the internet or disable public access to them.

PHP Versions Requiring Immediate Updates

The advisory identifies the following minimum versions to which affected systems should be upgraded:

• PHP 8.5: Upgrade to version 8.5.12 or later.
• PHP 8.4: Upgrade to version 8.4.27 or later.
• PHP 8.3: Upgrade to version 8.3.36 or later.
• PHP 8.2: Upgrade to version 8.2.35 or later.

The Centre has also warned that PHP 8.1 and older versions do not have the relevant security fixes available under the advisory. Organisations using these versions have been urged to migrate to newer, supported and secure releases.

Nepal’s Government and Private Sector Urged to Assess Risks

The advisory does not, by itself, confirm that any Nepalese website has been compromised through these vulnerabilities. However, it highlights the need for government agencies, media organisations, businesses, educational institutions and other service providers to assess whether their websites and servers are running affected PHP versions.

Cybersecurity experts generally recommend applying security patches promptly, checking system configurations and reviewing internet-facing services to minimise exposure to potential attacks.

Organisations unable to update immediately should consider restricting external access to vulnerable services until the necessary security measures can be implemented.

Why the Advisory Matters

PHP is widely used to develop websites and web applications, making security vulnerabilities in the language a potential concern for a broad range of online services. If vulnerable versions remain in use, systems could face increased exposure to cyber threats, depending on the nature of the flaws and how the affected software is deployed.

The National Cyber Security Centre’s advisory serves as a precautionary warning for organisations in Nepal to review their systems and take timely action rather than wait for an attack to occur.

Website administrators are encouraged to consult the official advisory and follow the recommended security updates.

Official advisory: https://sdoc.gov.np/notices/php-security-patches

Himalini Desk
Himalini.com English Edition