Nepal's Cybersecurity Wake-Up Call: Beyond the Patch
A critical PHP vulnerability forced Nepal to take government websites offline during the Dashain holidays, exposing deeper systemic weaknesses in how the country manages cybersecurity. While the patch itself is straightforward, the real challenge lies in knowing which systems need updating, who is responsible, and how to act fast enough in an era where AI-powered attacks exploit flaws within hours.
On Thursday morning, .gov.np websites became inaccessible, including those of the Office of the President, the Office of the Prime Minister, several ministries and many municipalities. Nepal was not alone. Finland shut down public web services, the Dutch cybersecurity agency took its own website offline, and Japan's Prime Minister took to X to urge organisations to apply security patches that night.
The cause was two critical flaws in Hypertext Preprocessor (PHP), the programming language behind a large share of the world's websites, including most WordPress sites. Discovered with the help of AI, the flaws allowed attackers to take control of web servers without passwords. A fix was released on Wednesday, and agencies worldwide issued the same advice: update immediately or take systems offline until they can be secured.
In Nepal, the government's Software Development and Operations Center (SDOC) issued an urgent notice and took websites offline as a precaution. Its teams have worked through the Dashain holidays to patch and test systems, restoring services as each is confirmed secure.
That was the responsible decision. A day offline is far better than stolen data or defaced official websites. But the episode should prompt a harder conversation, in both government and the private sector.
The Patch Is the Easy Part
I have seen the same pattern many times. Getting a patch is rarely the problem. The difficulty lies in everything around it: finding every system that needs it, understanding what depends on those systems and knowing what might break when the update is applied.
In Nepal, that challenge is particularly acute. PHP is the workhorse of our web industry. Thousands of websites belonging to government offices, banks, cooperatives, schools, hospitals and businesses run on it, often built by vendors whose contracts ended long ago. Many likely use older PHP versions that no longer receive security updates. Ask a typical office who is responsible for its website's security, and you may not get a clear answer.
That is why a fix released within hours can leave websites offline for days. Organisations recover quickly only when they know which systems they run, who maintains them and how to update them safely.
Researchers used AI to discover flaws that had remained undetected in PHP for more than a decade. Attackers have access to the same tools, and the gap between a vulnerability becoming public and criminals exploiting it is shrinking to hours. Nepal's small pool of experienced cybersecurity professionals cannot be everywhere at once. Organisations need to know their systems well enough to act as soon as an alert is issued, and they should start using AI for defence, too.
What Should Change
Nepal has made progress on paper. The 2023 National Cyber Security Policy envisions a National Cyber Security Centre, while Nepal Rastra Bank's Cyber Resilience Guidelines set expectations for banks. This week's events show what needs to happen next to turn policy into practice.
- First, every government body and regulated institution should maintain an up-to-date inventory of its internet-facing systems, including the software each runs and who is responsible for it. This sounds basic, yet few organisations anywhere can produce such an inventory quickly.
- Second, vulnerability management must become a formal, funded function, with a named owner, agreed deadlines for fixing critical flaws, an emergency budget and a tested plan for taking systems offline safely. It cannot be left to whoever happens to be available.
- Third, security must be built into contracts. Government procurement should require maintenance throughout a system's life cycle, and hosting providers, web agencies and vendors should be required to confirm in writing that critical security patches have been applied. Too many public websites are built, paid for and then forgotten.
- Finally, boards and senior leadership must treat cybersecurity as a governance issue, not a technical afterthought. They should ask the same questions they ask about financial risk: What are our critical systems? Who owns them? When were they last tested? What is our recovery plan?