PHP Security Flaws Prompt Website Shutdowns in Bangladesh, Including Bangladesh Bank
Bangladesh Bank and several commercial banks temporarily took their websites offline following a global PHP security alert. The central bank restored its website on October 25 after assessing the risks and taking protective measures.
Reading
In a Nutshell
- Two critical security flaws were uncovered recently in PHP, a widely used web programming language, which could allow attackers to execute commands on vulnerable servers without logging in.
- Bangladesh Bank took its website offline following this incident on October 22. Several commercial banks, including Agrani, Janata, IFIC, Standard Islami, SBAC and Bengal Commercial Bank followed.
- However, the shutdowns were precautionary, without confirmation if the banks had been hacked.
- Bangladesh’s national cybersecurity response team urged organisations to identify vulnerable PHP installations and apply security updates, prioritising systems accessible through the internet.
- Bangladesh Bank’s website resumed operation at 8 am on October 25. Its spokesperson said communications between the central bank and commercial banks had remained unaffected.
Context
PHP helps websites run services and process information. The newly disclosed flaws could let attackers run unauthorised commands on affected servers, making unpatched systems potential entry points for data theft or server takeover.
The disruption extended beyond Bangladesh. In Japan, banks, airlines and government bodies suspended some digital services while checking and updating their systems. Japanese Prime Minister Sanae Takaichi posted an urgent warning on X on October 21, 2026, regarding the security issue.
In Bangladesh, the alert initiated website shutdowns and security assessments across banks and government services. Bangladesh Bank has since restored its website. However, its reopening does not mean that every affected institution has completed its inspection.
Why It Matters
Bangladesh has already experienced serious failures in protecting digital information. In 2023, a government website exposed the personal details of an estimated 50 million citizens. In March 2026, attackers reportedly published more than 410 GB of Shwapno’s stolen data, including customer details and internal business records. The 2016 Bangladesh Bank cyberheist also saw $81 million stolen through fraudulent payment instructions. These incidents show that security failures expose people, not just computer systems to lasting risks.
What We Think
Although this is a global threat, the current website shutdowns are precautionary, not confirmation of another breach. That means temporarily restricting access to fix vulnerabilities is different from discovering that information has already been stolen. With banks and government services affected, it is important both protection and continuity like securing systems while keeping essential services available and clearly informing users about what is affected. A website coming back online is reassuring, but it is not, by itself, evidence that every vulnerable system has been secured.