Bangladesh Bank has restored its website after temporarily taking it offline as a precaution against potential cyberattacks following the discovery of two serious security vulnerabilities in the PHP programming language.
The website became operational again at 8am on Sunday, 25 October, after the risks had been assessed. It had been taken offline on Thursday amid concerns that the vulnerabilities could expose online systems to unauthorised access.
Arif Hossain Khan, spokesperson for Bangladesh Bank, confirmed that the shutdown had been prompted by urgent security concerns. He said the website was restored after an assessment of the potential risks.
According to sources at the central bank, technology specialists have been working to identify and address security weaknesses affecting the website. Several other bank websites built using PHP were also temporarily taken offline as a precaution against similar threats.
The vulnerabilities have raised concerns because they could potentially allow attackers to interfere with remote servers. According to international news agency AFP, hackers could exploit the flaws to execute unauthorised commands on servers without a password. If successfully exploited, such weaknesses could put server files, databases and other sensitive information at risk.
However, the discovery of a vulnerability does not necessarily mean that a website has been compromised. The actual level of exposure depends on factors including the software version in use, the server configuration and whether appropriate security measures have been implemented.
PHP is widely used to develop websites and web applications. Because vulnerabilities in widely deployed software can affect numerous systems, security advisories often prompt organisations to review their technology infrastructure and take preventive action before an attack occurs.
The potential threat has also prompted precautionary measures internationally. AFP reported that various government institutions in France, the Netherlands and Belgium had taken steps in response to the PHP security concerns.
In Bangladesh, officials from the government’s Aspire to Innovate (a2i) programme said approximately 36,500 websites operating under the National Portal Framework had not been developed using PHP. These websites were therefore not expected to be directly exposed to the specific vulnerabilities identified in the programming language.
That distinction is important, as the presence of a particular software vulnerability does not automatically place every website at risk. Nevertheless, websites built using other technologies can face separate security threats and still require regular maintenance, monitoring and protection.
Meanwhile, the Bangladesh Government’s e-Government Computer Incident Response Team (BGD e-Gov CIRT) has advised relevant organisations to check their PHP versions, install necessary security updates and restrict access to servers where appropriate.
Such measures can help reduce the likelihood of unauthorised access and limit the potential impact of cyberattacks. For financial institutions, protecting digital infrastructure is particularly important because disruptions can affect access to public information and online services, while successful attacks may expose sensitive data.
The restoration of Bangladesh Bank’s website marks the resumption of online access following the precautionary shutdown. The incident also highlights the importance of promptly addressing software vulnerabilities, maintaining up-to-date systems and coordinating cybersecurity responses across banks and government institutions.
Although the website is operational again, continued security monitoring and effective remediation remain essential to reducing the risk of future incidents.
