Bangladesh Bank website still offline over global PHP security vulnerability

The Bangladesh Bank has kept its official website offline to mitigate potential cyber attack risks following the identification of two critical security vulnerabilities in the PHP programming language.

Technical teams are reviewing the security risks to safely restore access as quickly as possible. Although the central bank's website was shut down on Thursday (October 22), it remained offline till Saturday.

A senior Bangladesh Bank official stated that the shutdown is not an isolated issue affecting Bangladesh Bank alone, but rather part of a global precautionary measure. The website will be restored once the risk assessment is complete.

Speaking on Thursday, Bangladesh Bank Spokesperson Arif Hossain Khan confirmed that the central bank's website was offline due to an urgent security issue.

Central bank sources revealed that IT specialists are actively working to detect and patch the vulnerabilities. Due to the same issue, several commercial banks utilizing PHP-based websites have also temporarily suspended their online platforms.

According to a report by international news agency AFP, attackers can exploit these PHP flaws to remotely execute unauthorized commands on servers without requiring passwords. This poses significant risks of compromising server files, databases, and sensitive information. Consequently, government institutions and digital services across France, the Netherlands, and Belgium have taken similar preventive actions.

Experts noted, however, that not all websites built on PHP are vulnerable, as the degree of risk depends on the specific version in use, security updates applied, and server security configurations.

Officials from the government's Aspire to Innovate (a2i) project clarified that around 36,500 websites under the National Portal Framework are not built on PHP, meaning they are not directly exposed to this specific vulnerability. Nevertheless, the underlying technologies of other government portals are being thoroughly audited.

Meanwhile, the Bangladesh Government Computer Incident Response Team (BGD e-GOV CIRT) has issued a security alert.

The agency advised relevant organizations to audit their servers to identify PHP usage and versions, ensuring immediate installation of necessary security patches. If immediate updates are not feasible, institutions have been urged to restrict server access and closely monitor unauthorized connections.