Oct 22, Kathmandu - A serious security vulnerability in PHP, one of the world’s most widely used programming languages, has affected government and public websites in several countries, including Nepal. Websites belonging to Nepal’s President’s Office, Prime Minister’s Office, ministries and local governments have reportedly become inaccessible.

Government agencies and media organizations in several countries have temporarily taken some online services offline as a precaution. Finland has suspended public web services, while Edinburgh Council in the UK and the BBC have taken some pages offline. The Netherlands’ cybersecurity agency has also said it would temporarily shut down its website.

According to Reuters, PHP developers issued an emergency security update on Wednesday and urged users to update their systems immediately. The report said artificial intelligence tools helped uncover vulnerabilities that had remained hidden in software for years.

Technology companies have warned that some hackers have already begun exploiting the flaw. Security experts say servers that remain unpatched are at risk—even after a fix becomes available. They are concerned that AI tools could make it easier to analyze the vulnerability and accelerate attacks on unprotected servers.

Developed in the early 1990s, PHP is used by popular website platforms including WordPress, Drupal, Joomla and Magento. Experts warn that the vulnerability could therefore affect a large number of websites and online services.

Tiffany Farris, interim chief executive of the Drupal Association, said servers running PHP versions released over the past 20 years could be at risk. Data from internet intelligence company Censys indicates that about 1.5 million of the 2.6 million hosts running PHP are still using versions without the security fix.

Cybersecurity agencies worldwide are urging users to install the update immediately. Those unable to update their systems have been advised to temporarily take vulnerable services offline.