Nepal Rastra Bank Pulls Websites Over Global PHP Flaw, Says Your Money Is Safe

Nepal Rastra Bank shut down its website and several online services on Friday, October 23, 2026, after a critical security flaw was found in PHP, the programming language that runs much of the world's websites, DC Nepal reported. Setopati dated the same notice to Thursday, October 22, a one day gap neither outlet explained. Some other government office websites were also taken offline after problems appeared in web technology, DC Nepal reported.

The shutdown disrupted online banking, new account opening, KYC, or Know Your Customer, detail updates and some digital payment services, bankers told OnlineKhabar, and Nagarik News reported the same disruption. Most banks, payment system operators and remittance companies also took their websites down, OnlineKhabar and Nagarik News reported. The Department of Revenue Investigation separately shut down its Vehicle Consignment Tracking System, known as VCTS, which tracks cargo trucks at checkpoints, and told drivers they must carry paper documents instead, Nepal Press reported. Ratopati reported the same shutdown and paper rule. Nepal Wire has not seen the department's own notice. If you planned to open an account, update your KYC or bank online, those web services were disrupted, though some banks have already restored theirs, OnlineKhabar reported.

Nepal Rastra Bank's spokesperson, Executive Director Guru Prasad Paudel, told OnlineKhabar the move was precautionary, not the result of a hack. "This was done as a precaution, the website has not been hacked," he said, adding that "the public's money in the bank is not at risk, nor has information been leaked." Nepal Bankers' Association chief executive Anil Sharma told Nagarik News banks were running security checks on the public details and services on their websites, and the problem had not touched any bank's core banking system. Nabil Bank's information technology chief, Pravesh Paudel, said Nabil's main websites were already patched and running again, OnlineKhabar reported.

The flaw behind it

PHP runs about 70 percent of the world's websites, including Wikipedia and WordPress, The Guardian reported, according to Setopati. Hackers could use the flaw to run their own code on a website, change its content or pull personal details from its database, Andrew Cullen, who teaches AI and cybersecurity at the University of Melbourne, told Al Jazeera, Setopati reported. Attackers could also read passwords held in server memory, the cloud security firm Wiz said, according to Setopati. Governments in France, the Netherlands, Canada, Japan and Germany took sites offline as a precaution, Setopati reported. Finland's government, the BBC and Wikimedia did the same, OnlineKhabar reported.

Researchers found the flaw with AI help and had planned to keep it quiet until October 22 so site owners could patch it first, but details leaked online earlier, forcing an early disclosure, Setopati reported. No successful attack has been confirmed so far, though Cloudflare and Palo Alto Networks logged hundreds of thousands of attempts, Nagarik News reported.

The bank has faced this before

On Sunday, December 17, 2023, a user calling themselves "badbuddha" claimed on a dark web forum to hold the bank's source code and sensitive data and asked $10,000 for it, OnlineKhabar English News reported. A bank employee told Techpana at the time it was not possible to say whether the claim was true, the outlet reported. The bank filed a complaint with the police Cyber Bureau, which handles cybercrime, on February 22, 2024. Police arrested a man from Kaski on March 14, 2024 and filed a case under the Electronic Transactions Act, 2008, OnlineKhabar English News reported. Nepal Wire could not confirm how that case ended.

What we still do not know

Whether Nepal Rastra Bank's website, online banking and VCTS are back up as of today. Neither the bank nor the Department of Revenue Investigation has given a timeline, and only their own spokespeople can confirm it.

Whether any outside, independent audit has checked the bank's claim that no money or data was touched, beyond its own statement. The National Cyber Security Centre or the bank's IT department could answer this.

Exactly which day Nepal Rastra Bank sent its shutdown notice to banks, since DC Nepal and Setopati give different days. The bank's communications office could settle this by releasing the dated notice.

Paudel told OnlineKhabar that technicians were still working to update the bank's systems, without giving a date for full restoration.