Sudden Digital Shutdown Across Nepal: Why Websites Went Dark?

When the Public Window Pulled Its Iron Shutters Down

For the average citizen waking up on a quiet festive morning, few things cause more immediate bewilderment than finding every major official portal abruptly inaccessible. During the Dashain break, a routine check for government gazettes, municipal tax guidelines, or commercial banking updates was met by a blank, unforgiving browser message: this site can’t be reached. Within hours, the public front doors of the Office of the President, the Office of the Prime Minister and Council of Ministers, and several key ministries vanished from the open internet. Shortly after, prominent commercial institutions—including Nabil Bank, Global IME Bank, NIC Asia Bank, and Siddhartha Bank—followed suit, taking their public web portals and specialized web services offline.

In our administrative corridors, rumors of cyber looting, data wiping, and national compromise travel faster than official press releases. The reality, however, was fundamentally different. Our core state infrastructure had not fallen victim to an active heist. Instead, our systems administrators deliberately pulled down the iron shutters (*dhoka banda*) from within. Faced with an invisible, structural security hole discovered in the global foundation of the internet, shutting the public counter was the only prudent administrative decision available to ensure that no unauthorized hands could walk through the front door.

Demystifying PHP: The Kitchen Behind the Administrative Counter

To appreciate what happened, we must move past abstract computational jargon and examine how digital governance functions in simple operational terms. When an ordinary citizen visits a public administrative office, say the Land Revenue Office (*Malpot*) or the Ward Office (*Woda Karyalaya*), they interact strictly through a customer service window. The citizen submits a request slip, the clerk accepts it, walks into the internal record room to retrieve the file from a wooden cabinet, stamps the document, and brings it back to the counter.

In the digital world, your computer or mobile screen is merely that service window. The record room cabinet is the institutional database, and the busy administrative clerk who retrieves, prepares, and presents the document is an invisible software engine called PHP. PHP is a server-side programming language that processes commands behind the scenes. Because it is freely available and easy to deploy, PHP has quietly become the working engine for nearly seventy percent of all traceable web platforms globally. In our local context, almost every government platform ending in `.gov.np`, alongside municipality dashboards, news channels, and content platforms like WordPress, relies directly on this single software engine to run.

The Master Key Without an Identity Card: Remote Code Execution

The entire global crisis arose because security researchers, using modern Artificial Intelligence tools, discovered two deep-seated structural flaws in the core architecture of PHP, categorized technically as CVE-2026-109618 and CVE-2026-109619. Both vulnerabilities received an alarming severity score of 9.2 out of 10, placing them among the most dangerous software bugs ever audited.

In a properly functioning digital office, an outsider must provide a valid identity card—a verified username and password—before the clerk allows them to touch official records. The fatal problem with these newly exposed flaws is that they allow what engineers call unauthenticated Remote Code Execution. To put it plainly, an unknown actor sitting thousands of miles away can send a specially distorted message across the internet that confuses the internal clerk.

Instead of asking for an identity card, the software's memory management and error handling become completely disordered. The software mistakenly begins executing raw computer commands dictated by the anonymous stranger, handing them an invisible master key to the back office without requiring a login. From there, an unauthorized entity could inspect protected records, alter public notices, or turn the government machine into a tool for attacking others.

The Global Reaction and the Race Against Automated Scanners

The moment these architectural weaknesses were publicly disclosed alongside initial security patches, a fierce global race erupted. Bad actors immediately deployed automated software bots to scan the entire worldwide web, rattling every digital door handle to find machines that had not yet applied the fix. International cloud defense networks detected millions of unauthorized scanning attempts within just forty-five minutes of disclosure.

Because an unpatched system represents an open door, major international agencies issued uncompromising emergency guidance. The United States National Security Agency (NSA) and the FBI advised organizations through public channels to disconnect their web platforms immediately if security updates could not be deployed instantly.

Nepal’s preventive measures were mirrored by prominent public bodies worldwide. In the United Kingdom, certain public portals of the BBC and the City of Edinburgh Council went offline. The Finnish government temporarily disconnected multiple public web services. The Dutch national cyber security agency temporarily suspended its own portal, while authorities across Germany, France, and Japan isolated critical websites to insulate internal networks from harm.

The Response in Kathmandu: Safeguarding Citizen Records and Money

Recognizing the gravity of the situation, our central authorities acted decisively. The Software Development and Operation Centre under the Office of the Prime Minister and Council of Ministers mobilized an emergency technical team alongside IT bodies to isolate exposed infrastructure. Soon after, the National Cyber Security Centre issued a high-priority cyber security advisory mandating government departments and commercial enterprises to upgrade their PHP versions immediately to versions 8.2.35, 8.3.36, 8.4.27, or 8.5.12, and to pull vulnerable servers offline until patched.

Simultaneously, Nepal Rastra Bank issued formal directives instructing commercial banks, payment gateways, and remittance intermediaries to heighten system monitoring and temporarily suspend public-facing web portals. Commercial institutions responded systematically. Prime Commercial Bank closed online account opening and loan inquiry portals, Global IME Bank temporarily suspended its digital uniVerse interface for maintenance, and Nabil Bank paused web-based card and deposit applications.

It is vital for the general public to understand the clear operational division that was maintained. While public web portals were down—meaning one could not look up interest rates, download bank forms, or view government press releases—the core transactional machinery remained completely intact and secure. The President of the Nepal Bankers' Association and spokespersons from Nepal Rastra Bank confirmed that Automated Teller Machines (ATMs), Point of Sale (POS) machines in stores, and mobile banking applications utilizing QR networks such as Fonepay and NepalPay operated normally without disruption. Not a single paisa of citizen savings or institutional ledger data was lost or compromised.

The Dashain Dilemma and the Path to Modernized Administration

If applying a software patch takes only four to five hours under regular conditions, why did several public portals remain offline for days? The delay was rooted in an entirely human and seasonal administrative reality: the festival of Dashain.

Across our administrative structure, senior technical staff and system developers had dispersed to their hometowns and ancestral villages. With personnel away from regional data centers, verifying custom code, auditing third-party plugins, and coordinating upgrades took longer than usual. While the public holidays cushioned the impact on everyday citizen paperwork because physical administrative counters were already shut, it inevitably delayed the redeployment of public sites.

Furthermore, our state apparatus continues to wrestle with technical debt. While modern portals updated swiftly, numerous legacy systems remain chained to outdated, unsupported frameworks such as PHP 8.1 or older. For these obsolete frameworks, ready-made security patches do not exist; developers must carefully refactor legacy code to avoid crashing the underlying application.

Ultimately, this unprecedented shutdown offers a fundamental governance lesson for Nepal. A modern digital office cannot simply be contracted out to a software vendor once and forgotten. It requires continuous maintenance, periodic upgrades, and dedicated domestic institutional capacity. Seeing our public websites display temporary maintenance notices was undoubtedly frustrating, but taking a scheduled, preventive pause was far wiser than allowing our nation's sovereign administrative records to sit unlocked before the world.