Bangladesh Bank’s official website remains inaccessible after two serious security vulnerabilities were identified in the PHP programming language, prompting authorities to temporarily shut down the site as a precaution against potential cyberattacks.

Officials are reviewing the security risks and working to restore the website as soon as it is considered safe.

The central bank’s website was taken offline on Thursday, October 22, and remained unavailable as of Saturday.

A Bangladesh Bank official said the shutdown was not an isolated measure affecting the central bank alone, but part of a broader international precautionary response. The website will be restored after the risks have been assessed, the official added.

On Thursday, central bank spokesperson Arif Hossain Khan confirmed that the website had been shut down because of an urgent security issue.

Sources at Bangladesh Bank said technical specialists were working to identify and address the website’s security weaknesses. Several other bank websites built using PHP have reportedly been taken offline temporarily for similar reasons.

According to a report by international news agency AFP, attackers could potentially exploit the PHP vulnerabilities to execute unauthorized instructions on remote servers without requiring a password. Such attacks could put server files, databases and other sensitive information at risk.

As a precaution, government institutions and digital services in France, the Netherlands and Belgium have also introduced security measures, the report said.

However, not every website built using PHP is necessarily vulnerable. The level of risk depends on factors including the PHP version in use, whether security updates have been installed and the protective measures implemented on the server.

Government Reviews Potential Risks to Public Websites

Officials from the government’s Aspire to Innovate (a2i) programme said approximately 36,500 websites operating under the National Portal Framework were not built using PHP. As a result, those websites are not expected to be directly affected by the specific vulnerabilities.

Authorities are nevertheless checking the technologies used by websites operated by other government institutions to determine whether additional precautions are necessary.

Meanwhile, Bangladesh’s government cybersecurity agency, BGD e-GOV CIRT, has issued an alert regarding the vulnerabilities.

The agency has advised relevant organizations to identify whether PHP is being used on their servers, determine the versions installed and ensure that all necessary security updates are applied.

Where immediate updates are not possible, organizations have been advised to restrict access to affected servers and monitor connections for unauthorized activity.

The temporary shutdown of Bangladesh Bank’s website underscores the importance of assessing software vulnerabilities and applying appropriate security measures before restoring potentially exposed online services.