Health Ministry orders urgent security upgrades to PHP, Node.js systems

KATHMANDU: The Ministry of Health and Food Safety has directed all departments, hospitals, centers and offices under its jurisdiction to urgently fix critical cybersecurity vulnerabilities in PHP and Node.js systems to protect sensitive patient information and prevent unauthorized access.

In a notice, the ministry said the National Cyber Security Center had issued advisories on two PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, and a Node.js vulnerability known as Node2Shell (CVE-2026-111497). Exploitation could allow unauthorized access, disrupt services or enable attackers to take control of systems.