Play store
Bangladesh Bank’s website remained inaccessible on Saturday, two days after it was temporarily shut down over fears of cyberattacks linked to two serious security vulnerabilities in the PHP programming language.
The central bank is reviewing the risks and working to restore the website as soon as possible, officials said.
A Bangladesh Bank official said the shutdown was part of a precautionary measure being taken globally, rather than an issue affecting the central bank alone. The website would be restored after a risk assessment, the official added.
On Thursday (October 22), Bangladesh Bank spokesperson Arif Hossain Khan said the website had been taken offline due to an urgent security concern.
Sources at the central bank said technology specialists were working to identify and address the website’s security vulnerabilities. Several other bank websites built using PHP have also been temporarily shut down for the same reason.
According to a report by international news agency AFP, attackers could exploit the PHP vulnerabilities to execute unauthorised commands on remote servers without a password. This could put server files, databases and sensitive information at risk.
As a precaution, various government agencies and digital services in France, the Netherlands and Belgium have also taken protective measures.
However, not all websites using PHP are necessarily vulnerable. The level of risk depends on the version in use, the availability of security updates and the server’s protective measures.
Officials of the government’s Aspire to Innovate (a2i) programme said around 36,500 websites under the National Portal Framework were not built using PHP and were therefore not expected to be directly affected by these specific vulnerabilities. Authorities are, however, checking the technologies used by websites of other government institutions.
Meanwhile, the government’s cybersecurity agency, BGD e-GOV CIRT, has issued an alert on the vulnerabilities.
The agency has advised relevant organisations to identify whether PHP is being used on their servers, determine the versions in use and apply the necessary security updates. If immediate updates are not possible, organisations have been advised to restrict server access and monitor unauthorised connection attempts.