Play store
Bangladesh has issued a high-level cybersecurity alert following the discovery of two critical security vulnerabilities in the widely used PHP programming language, prompting organisations to take precautionary measures, including temporarily shutting down some websites.
The government’s Computer Incident Response Team, BGD e-GOV CIRT, has issued a warning over the vulnerabilities, known collectively as “PHP2Shell”, which could allow attackers to execute unauthorised commands on servers remotely without authentication.
The vulnerabilities have raised concerns worldwide, as PHP is widely used to develop and operate websites, including government portals, banking services, news platforms and e-commerce sites.
In response to the threat, Bangladesh Bank temporarily took its official website offline on Thursday as a precautionary measure.
The central bank said its IT team was examining the security risks and working to address potential vulnerabilities.
However, internet banking and mobile banking transactions continued to operate normally, according to reports.
The cybersecurity concerns have also prompted precautionary measures in several countries, including France, the Netherlands and Belgium, where government agencies and other organisations have temporarily taken some websites offline while assessing their exposure to the threat.
Cybersecurity experts have advised organisations using PHP to identify the versions running on their servers and install the necessary security updates as soon as possible.
Those unable to apply the fixes immediately have been urged to consider restricting access or temporarily taking vulnerable systems offline.
Officials have stressed the importance of assessing individual systems, as using PHP does not automatically mean that a website is vulnerable.
The alert comes amid growing concerns about the use of artificial intelligence in identifying software weaknesses and the possibility that attackers could exploit publicly disclosed vulnerabilities before all affected systems are secured.
Authorities and organisations are continuing to assess the risks and strengthen their cybersecurity measures to prevent potential attacks and protect sensitive information.
