Two critical vulnerabilities in PHP, collectively nicknamed PHP2Shell, surfaced in October 2026[cite: 16]. Triggering emergency defensive responses worldwide, organisations across Nepal temporarily took their web applications offline to apply vital security patches[cite: 16].
PHP2Shell refers to two critical vulnerabilities (CVE-2026-109618 and CVE-2026-109619) found deep within the core framework of PHP[cite: 16]. Because PHP underpins nearly 70 percent of all identifiable websites globally, the scope of exposure is vast[cite: 16]. Both flaws carry a severe CVSS score of 9.2 out of 10, enabling unauthenticated attackers to execute arbitrary system commands on underlying web servers[cite: 16].
Crucially, because the flaw exists inside PHP itself rather than application scripts, even immaculately coded websites built on popular CMS platforms like WordPress, Joomla, Drupal, or Magento remain inherently vulnerable if running an unpatched runtime environment[cite: 16].
| Date | Event Overview | Status |
|---|---|---|
| 20 October 2026 | Vulnerability details became public before official fixes were fully deployed[cite: 16]. | Disclosure |
| 21 October 2026 | PHP released emergency security patches (versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35). Nepal's NCSC issued advisories[cite: 16]. | Patch Release |
| 22 October 2026 | Major Nepali government portals, NRB, and commercial banks went offline as a precaution[cite: 16]. | Precautionary Shutdown |
| 25–26 October 2026 | SDOC patched shared platforms, bringing thousands of websites back online safely[cite: 16]. | Restoration Phase |
Cybersecurity frameworks recommend immediate patching; where instant patching is impossible, taking systems offline remains a recognized defensive safeguard[cite: 16]. Attackers mobilized immediately following disclosure. Media reports citing Cloudflare telemetry highlighted tens of thousands of automated attack attempts within just 45 minutes of the news breaking, alongside confirmed exploitation in the wild[cite: 16]. Pausing public availability prevented potential automated server compromises.
A scheduled website outage for security patching is distinct from a confirmed data breach; reports have not indicated citizen data loss resulting from the PHP2Shell response[cite: 16]. Users are advised to rely strictly on official channels and avoid entering sensitive login or financial details onto unverified lookalike domains during temporary public service disruptions[cite: 16].
As Nepal’s digital ecosystem continues expanding across banking, public services, and governance, maintaining software integrity is paramount[cite: 16]. Routine patching, supported version management, and robust response readiness safeguard both digital availability and user trust[cite: 16].
One Cover Pvt. Ltd. delivers comprehensive Vulnerability Assessment and Penetration Testing (VAPT), web application security reviews, and tactical cybersecurity advisory services[cite: 16]. If your enterprise operates PHP-based infrastructure and requires an expert security posture review, get in touch with our team today.