Bangladesh Bank has restored its website after temporarily taking it offline as a precaution against potential cyberattacks following the discovery of two serious security vulnerabilities in the PHP programming language.
The website became operational again at 8am on Sunday, 25 October, following an assessment of the potential risks. It had been taken offline on Thursday amid urgent security concerns.
Arif Hossain Khan, spokesperson for Bangladesh Bank, confirmed that the website had been suspended temporarily for security reasons. He said it was restored after the risks had been assessed. However, no detailed information was provided about the specific technical measures taken to address the vulnerabilities.
According to sources at the central bank, technology specialists have been working to identify and resolve weaknesses affecting the website. Several other bank websites built using PHP were also temporarily taken offline as a precaution against similar threats.
The security concerns extend beyond Bangladesh. According to international news agency AFP, hackers could exploit the PHP vulnerabilities to execute unauthorised commands on remote servers without a password. If successfully exploited, the flaws could expose server files, databases and other sensitive information to potential compromise.
The discovery of a vulnerability does not necessarily mean that a website has been hacked. The actual level of risk depends on factors such as the software version in use, server configuration and the security measures already in place. Nevertheless, serious vulnerabilities can create opportunities for attackers if organisations fail to address them promptly.
PHP is widely used to build websites and web applications. Because the programming language supports a broad range of online services, security flaws can become a concern for organisations that rely on affected versions. Timely software updates, vulnerability assessments and appropriate access controls are among the measures used to reduce such risks.
AFP reported that various government institutions in France, the Netherlands and Belgium had also taken precautionary measures in response to the PHP security concerns. The developments indicate that the vulnerabilities have attracted attention beyond Bangladesh, although the precise measures adopted by individual institutions were not detailed in the report.
In Bangladesh, officials from the government’s Aspire to Innovate (a2i) programme said approximately 36,500 websites under the National Portal Framework had not been developed using PHP. Those websites were therefore not expected to be directly exposed to the specific vulnerabilities identified in the programming language.
However, the use of different technology does not guarantee complete protection against cyber threats. Websites can face other vulnerabilities involving their software, servers or access controls, making routine security checks important regardless of the platform used.
Meanwhile, the Bangladesh Government’s e-Government Computer Incident Response Team (BGD e-Gov CIRT) has advised relevant organisations to verify their PHP versions, install necessary security updates and restrict server access where appropriate.
These measures are particularly important for banks and other financial institutions, where disruptions to digital infrastructure can affect access to information and online services. A successful cyberattack may also expose sensitive data, depending on the systems affected and the nature of the breach.
The restoration of Bangladesh Bank’s website has ended the immediate interruption to public access. However, bringing a website back online is only one part of managing a cybersecurity incident. Identifying the underlying weakness, applying effective fixes and monitoring systems for further threats are also essential.
The incident highlights the importance of regular security assessments and timely responses to software vulnerabilities across Bangladesh’s banking sector and public digital infrastructure. Continued vigilance will be necessary to reduce the risk of similar disruptions in the future.
