The website was taken offline on Thursday afternoon after Bangladesh Bank received a warning about potential cybersecurity vulnerabilities. The decision was intended to allow the authorities to assess possible risks and strengthen the website’s defences before making it available to the public again.
Arif Hossain Khan, executive director and spokesperson for Bangladesh Bank, said the website had not yet been restored because the authorities wanted to ensure that the necessary security measures were in place.
He confirmed that connections between the central bank and commercial banks continued to function normally. The website’s temporary closure had therefore not disrupted their routine operations, according to the spokesperson.
Bangladesh Bank’s information technology department is working to address the issue and assess the security situation. However, no specific timeline has been announced for restoring public access.
As of 8am on Saturday, the website remained inaccessible. Visitors attempting to access it were shown a maintenance-related message instead of the usual content, temporarily preventing them from consulting information and services available through the platform.
Global concern over PHP security vulnerabilities
The precautionary move comes amid international concern over serious security vulnerabilities identified in PHP, a widely used programming language for developing websites and web applications.
Cybersecurity companies Calif and Wiz reportedly identified the vulnerabilities using artificial intelligence technology. The findings have drawn attention to potential weaknesses in digital infrastructure, prompting the government to issue a warning about global cybersecurity risks.
PHP is used to build and operate a wide range of websites and online applications. Like other software technologies, it can be affected by security flaws that, depending on their nature and the configuration of the affected systems, may expose organisations to unauthorised access, data theft or service disruption.
When serious vulnerabilities are identified, organisations may need to review their systems, assess potential exposure and introduce appropriate safeguards. Temporarily taking a website offline can be one precautionary measure while security checks are carried out.
However, Bangladesh Bank has not confirmed that its website was directly targeted in a cyberattack connected to the current alert. The closure has been described as a precautionary step, with officials emphasising the need to ensure adequate protection before restoring access.
The shadow of the 2016 cyber heist
The latest development has renewed attention on the cybersecurity challenges facing Bangladesh’s financial sector, particularly in light of the central bank’s experience of a major cyber heist in 2016.
In that incident, hackers transferred US$101 million from Bangladesh Bank’s account at the Federal Reserve Bank of New York. The theft became one of the most widely discussed cybercrime cases involving a central bank and raised serious questions about the protection of international financial transactions.
Following the incident, then governor Atiur Rahman resigned. The episode also prompted greater scrutiny of the security arrangements used to protect financial institutions, sensitive information and payment systems.
Cybersecurity is especially important for central banks because their digital infrastructure supports essential financial functions and handles sensitive data. Weaknesses in these systems can create risks extending beyond a public-facing website, potentially affecting confidential information or the continuity of financial services if connected systems are compromised.
In the current situation, however, Bangladesh Bank has maintained that its connections with commercial banks remain unaffected. The temporary closure of its website should therefore be distinguished from any disruption to the systems supporting routine banking operations.
For now, the central bank’s priority is to complete the necessary security checks before bringing the website back online. With no reopening date announced, public access remains suspended while its information technology department continues working on the issue.
