The central bank took the website offline on Thursday afternoon after receiving a warning about potential cybersecurity vulnerabilities. Since then, its information technology department has been assessing the security situation and working to strengthen the website’s defences before restoring public access.
Arif Hossain Khan, executive director and spokesperson for Bangladesh Bank, said the website had not been reopened because the authorities wanted to ensure that its security was fully addressed.
He confirmed that connections between Bangladesh Bank and commercial banks remained operational, with no disruption reported to their regular activities as a result of the website closure.
The central bank’s information technology department is working on the issue, he added, but no specific deadline has been announced for restoring the website.
As of 8am on Saturday, the website remained inaccessible to users. Attempts to visit the platform displayed a maintenance-related message instead of the usual content, temporarily preventing visitors from accessing information and services available through the site.
Global concern over PHP security vulnerabilities
The precautionary move comes amid international concern over serious security vulnerabilities identified in PHP, a widely used programming language for developing websites and web applications.
Cybersecurity companies Calif and Wiz reportedly identified the vulnerabilities using artificial intelligence technology. The developments have raised concerns about potential weaknesses in digital infrastructure, prompting the government to issue an alert regarding global cybersecurity risks.
PHP is used by a wide range of websites and online applications. Like other software technologies, it can be affected by security flaws that may expose systems to unauthorised access, data theft or service disruption, depending on the nature of the vulnerability and the configuration of the affected system.
When serious vulnerabilities are identified, organisations may need to assess their exposure, review their security arrangements and implement appropriate safeguards. Temporarily taking a website offline can be one precautionary measure while those checks are carried out.
However, Bangladesh Bank has not confirmed that its website was directly targeted in a cyberattack linked to the current alert. The reported action is precautionary, and officials have emphasised the need to ensure adequate protection before restoring access.
The lasting impact of the 2016 cyber heist
The current closure has drawn attention to the cybersecurity challenges facing Bangladesh’s financial sector, particularly given Bangladesh Bank’s experience of a major cyber heist in 2016.
In that incident, hackers transferred US$101 million from Bangladesh Bank’s account at the Federal Reserve Bank of New York. The theft exposed serious weaknesses in the protection of financial transactions and became one of the most prominent cybercrime incidents involving a central bank.
Following the incident, then governor Atiur Rahman resigned. The episode also prompted wider scrutiny of the security measures used to protect financial institutions, sensitive information and international payment systems.
Cybersecurity is particularly important for central banks because their digital infrastructure supports essential financial operations and handles sensitive data. A security breach can have consequences extending beyond a public-facing website if connected systems or financial services are affected.
In the present case, Bangladesh Bank has maintained that its connections with commercial banks are functioning normally. The website’s temporary closure therefore needs to be distinguished from any disruption to the systems supporting routine banking operations.
The immediate priority is to ensure that the website is adequately protected before it is brought back online. Until the necessary checks are completed, public access will remain restricted. With no reopening date announced, users are awaiting a further update from the central bank.
