Some government websites and digital systems in Nepal have been temporarily taken offline following the disclosure of two critical security vulnerabilities affecting PHP-based systems. According to an urgent security notice issued by the Software Development and Operations Centre (SDOC), the vulnerabilities, identified as “PHP2Shell” and listed as CVE-2026-109618 and CVE-2026-109619, carry a reported CVSS score of 9.2, classified as critical. The