Bangladesh Bank (BB) has temporarily shut down its website, https://www.bb.org.bd/, to prevent cyber attack risks after two critical security vulnerabilities were detected in the PHP programming language.
BB Executive Director and Spokesperson Arif Hossain Khan confirmed on Thursday at around 7:24pm, that the website is down due to an urgent security issue.
A BB official said the shutdown is part of a global precautionary measure, not solely a BB issue. The website will be restored after a risk analysis is completed.
Sources at the central bank said technicians are working to identify and address the website’s security weaknesses. Several other PHP-based bank websites have also been temporarily shut down for the same reason.
According to an AFP report, the PHP flaws allow attackers to remotely execute unauthorised commands on servers without a password. This puts server files, databases and sensitive information at risk. Consequently, various government institutions and digital services in France, the Netherlands and Belgium have also taken precautionary measures.
However, not all websites using PHP are at risk. The level of risk depends on the version used, security updates and the server’s protection systems.
Officials from the government’s Aspire to Innovate (a2i) programme said that nearly 36,500 websites under National Portal Framework are not built on PHP, meaning they are not directly at risk from this specific flaw. However, the technology used in the websites of other government institutions is being verified.
The government’s cyber security agency, BGD e-GOV CIRT, has issued a warning on the matter. It advised relevant institutions to identify the use and version of PHP on their servers and ensure necessary security updates. If immediate updates are not possible, it recommended measures such as limiting server access and monitoring unauthorised connections.
