Bangladesh Bank Shuts Down Its Website as a Global PHP Security Flaw Triggers a Worldwide Scramble

Bangladesh Bank pulled its official website offline on the afternoon of Thursday, October 22, as a precaution after security researchers discovered a pair of severe flaws in PHP, the programming language that quietly runs a large share of the world's websites, including government portals from Dhaka to The Hague. The outage is still in place, and the central bank has not said when the site will return.

• Bangladesh Bank took its website down as a precaution, not because of a confirmed attack on the bank itself.
• The flaws, nicknamed "PHP2Shell," could let an attacker take over a vulnerable website; patches exist but many servers have not applied them yet.
• Internet banking, mobile banking and card transactions are working normally, the bank and depositors both say.
• Government agencies in the Netherlands, France, Denmark and Finland, among others, have taken similar precautions this week.

What happened

Visitors to bangladeshbank.org.bd have seen only a maintenance notice since around noon on Thursday, promising the service would "be back online shortly." Arief Hossain Khan, the central bank's executive director and spokesperson, confirmed the shutdown to reporters that evening. "The website has been taken offline as a security precaution following the emergence of global cyberattack risks," he said, adding that the bank's IT department was working on the problem. He did not give a timeline for restoring the site.

The timing is awkward. Bangladesh is in the middle of a five day bank holiday for Durga Puja, when branch counters are closed but digital channels are supposed to carry the load. Bank officials and customers contacted by Prothom Alo said internet banking, mobile banking and card payments continued to work normally through Thursday night, and that only the public-facing website, used mainly for notices, circulars and statistics, was affected.

Why now: the PHP2Shell scare

The immediate trigger came from outside Bangladesh. Researchers, in one case reportedly using an AI tool to comb through code, found two critical vulnerabilities in PHP, the decades old scripting language that the Prothom Alo report says still powers close to seven in ten websites worldwide. Exploiting the flaws could let an unauthorised party effectively seize control of a website built on PHP. The PHP development team rushed out emergency patches on Wednesday, but because word of the vulnerabilities spread before every server could be updated, security agencies in several countries advised organisations to take vulnerable sites offline rather than risk being caught exposed.

Bangladesh's own Government Computer Incident Response Team, BGD e-Gov CIRT, issued a warning on Thursday naming the vulnerabilities and urging agencies running PHP based systems to check their exposure immediately. Bangladesh Bank's website runs on PHP, which is why it came down even though there is no public claim that anyone actually broke in. BBC cyber affairs correspondent Joe Tidy, quoted in Bangladeshi coverage of the episode, called it "an unprecedented situation where IT teams have been scrambling" to shore up their systems before attackers could exploit the gap.

"The website has been taken offline as a security precaution following the emergence of global cyberattack risks," said Arief Hossain Khan, Executive Director and spokesperson, Bangladesh Bank.

Organisation	Country	Action taken
Bangladesh Bank	Bangladesh	Website taken offline as precaution
Edinburgh City Council	United Kingdom	Website taken offline
BBC (Doctor Who section)	United Kingdom	Section taken offline
Government agencies	Netherlands, France, Denmark, Finland	Sites taken offline as precaution
Several private companies	Japan, Belgium, Netherlands	Services suspended temporarily

Not Bangladesh Bank's first brush with cyber fear

For a central bank, caution is not a reflex without history behind it. In 2016, hackers used the SWIFT international payment network to divert $101 million from Bangladesh Bank's account at the Federal Reserve Bank of New York, in what remains one of the largest cyber heists ever attempted against a central bank. The scandal forced the resignation of then governor Atiur Rahman and left the institution acutely sensitive to anything that smells like a repeat. In 2023, it closed several internal web based services for 36 hours as a precaution against a possible attack, with no breach ultimately confirmed. Thursday's shutdown fits the same pattern: act first on a plausible global threat, sort out the details later.

Notably, other Bangladeshi financial regulators took a different approach. The Bangladesh Securities and Exchange Commission, the Financial Institutions Division of the finance ministry, the Dhaka Stock Exchange and the Insurance Development and Regulatory Authority all kept their websites running through Thursday, suggesting the central bank made its own, more conservative call rather than following a sector wide directive.

What it means for you

For ordinary depositors, borrowers and businesses, the practical impact so far is close to zero. No bank has reported disrupted transfers, card declines or app outages tied to this episode, and Bangladesh Bank's own statement is explicit that only the website, not its banking systems, is affected. If you were trying to download a circular, check a foreign exchange rate table or read a notice on bb.org.bd, you will need to wait or ask your bank directly, since many lenders republish key Bangladesh Bank circulars on their own websites and through RSS style updates.

The bigger lesson for anyone running a Bangladeshi business with its own website, from small e-commerce shops to trade licence portals, is that the underlying flaw, PHP2Shell, is not specific to banks. It affects any site built on PHP, which includes a large share of small and medium sized Bangladeshi business sites hosted cheaply on shared servers. If your developer has not applied the emergency PHP patch released this week, that is worth checking before anything else on your to do list.

What happens next

Bangladesh Bank has not set a timeline for bringing bangladeshbank.org.bd back online, and as of Thursday night the maintenance notice was still live. Given the precedent of the 2023 shutdown, a return within one to three days would not be unusual once the IT department confirms the PHP patch is applied and the site has been checked for any tampering. The bigger question, raised by the scale of this week's global scramble, is whether Bangladesh's wider network of government and financial websites, many of them also built on PHP and hosted with uneven security budgets, will get the same scrutiny before the next scare arrives.