Bangladesh Bank's Website Is Back Online, With No Breach Confirmed After the Three Day Shutdown
Bangladesh Bank restored its website on Sunday morning, three days after taking it offline over a newly discovered PHP security flaw that put government and bank websites around the world on alert. No breach of the central bank's systems has been confirmed, and officials say internet banking and mobile financial services kept running normally throughout. The bigger risk now is the scam messages such scares tend to trigger.
Bangladesh Bank's website is back. The central bank restored its site at 8am on Sunday, three days after taking it offline as a precaution against a global wave of cyberattack fears tied to a newly discovered flaw in PHP, the programming language that runs a large share of the world's websites. No breach of Bangladesh Bank's systems has been confirmed, and officials say the shutdown was always meant to be temporary.
- Bangladesh Bank's website went dark on Thursday, October 22, and came back online at 8am on Sunday, October 25.
- The cause was two critical PHP vulnerabilities, rated 9.2 out of 10 for severity, that could let an attacker run code on a server without logging in.
- No confirmed attack or data breach involving Bangladesh Bank has been reported.
- Internet banking and mobile financial services kept running normally throughout, with no disruption to customer transactions.
What actually happened
The central bank pulled its own website offline on Thursday as warnings spread about two newly disclosed flaws in PHP, tracked as CVE-2026-109618 and CVE-2026-109619. Bangladesh Bank spokesperson and Executive Director Arif Hossain Khan said technical teams used the downtime to check the site for vulnerabilities and software bugs, describing it as "a preventive measure in response to global warnings about cyberattacks." The land services portal and the websites of several private commercial banks went offline around the same time, as institutions across the country moved to run the same checks. By Sunday morning, Khan said, "the risk has subsided," and the site was switched back on. Some other banks' sites were still working through their own risk assessments as of the weekend.
A flaw that worried governments well beyond Dhaka
The PHP vulnerabilities behind the scare affect any server running the language, including sites built on WordPress, Drupal, and Joomla, which together power a significant share of the internet. The US Cybersecurity and Infrastructure Security Agency has nicknamed the exploit chain "php2shell." Fixes are available in PHP versions 8.5.12, 8.4.27, 8.3.36, and 8.2.35, but patching millions of servers takes time, and proof-of-concept exploit code was already circulating publicly within days of disclosure. The Netherlands took down government portals including its DigiD digital identity system, Finland pulled several public services offline, France closed prefecture websites, and Japan's prime minister urged a nationwide check of government sites running PHP. Security researchers reported attack attempts in multiple countries, though none had been confirmed successful at the time Bangladesh Bank restored its own site.
No evidence of a breach, officials say
Bangladesh Bank has been explicit that the shutdown was precautionary rather than a response to an actual intrusion. Earlier in the week, the central bank stated publicly that no Bangladeshi bank website had been hacked, moving to get ahead of rumours as screenshots and speculation circulated online once multiple bank sites went dark at once. Throughout the three days, officials repeated that internet banking, mobile financial services, and card transactions continued without interruption, since those core banking functions do not run through the public-facing website that was taken down.
What it means for you
If you bank in Bangladesh, your deposits, transfers, and card payments were never actually at risk from this specific episode, since the website that went dark is an information portal rather than the infrastructure that moves money. The more practical risk for ordinary customers is a secondary one: moments like this are exactly when scam text messages and fake "your bank account is suspended, click here to verify" links tend to circulate, preying on anxiety about a cyberattack that was in the news. Treat any unexpected message asking for your PIN, OTP, or card details as fraudulent regardless of how urgent it sounds, and reach your bank only through the phone number printed on your card or passbook. For businesses that rely on Bangladesh Bank's website for circulars, exchange rate notices, or regulatory updates, the safest move during any similar outage is to wait for official confirmation rather than acting on unverified screenshots shared on social media.
What happens next
Bangladesh Bank has not said whether it will publish a fuller account of what its technical review found, or whether any of the handful of other Bangladeshi bank and government websites that went offline in the same window are still awaiting the all-clear. The broader PHP flaw is not specific to Bangladesh, so the real test is whether the country's banks and government portals stay current on security patches once attention moves elsewhere, since the proof-of-concept code now public means the vulnerability does not disappear just because the immediate panic has passed.
| Date | Event |
|---|---|
| Thursday, Oct 22 | Bangladesh Bank takes its website offline as a precaution; other bank and government sites follow |
| Oct 22 to 23 | Bangladesh Bank states publicly that no Bangladeshi bank website has been hacked |
| Oct 23 to 24 | Site remains offline while technical teams complete checks; some other banks' sites still under review |
| Sunday, Oct 25, 8am | Bangladesh Bank's website is restored after officials say the risk has subsided |
References
Free calculators
All calculatorsEMI & loan calculator
Monthly installment, total interest and a full repayment schedule. Compare two loan offers side by side.
Zakat calculator
Work out your nisab status and the 2.5% zakat due on cash, gold, silver, savings and business assets.
FDR & DPS maturity calculator
Maturity amount for a fixed deposit or monthly deposit scheme, after compounding and source tax.
Read next
Bangladesh Bank's Tk2,000 Crore Frozen Food Fund Picks Up Four Banks in a Week
Bangladesh Bank has signed up a fourth commercial bank in just over a week to channel pre-financing loans from its Tk2,000 crore fund for frozen food exporters. The scheme offers concessional loans at up to 7 percent to shrimp, fish and other frozen food producers who are struggling with falling demand in the US and Europe. Mercantile Bank, NRBC Bank, IFIC Bank and Community Bank have all signed participation agreements since the start of November. The push comes as Bangladesh's frozen food exporters look for new buyers to replace shrinking orders from their traditional Western markets.
Bangladesh Bank Flips the Funding Order on Its Tk20,000 Crore Factory Revival Scheme After Banks Barely Touch It
Bangladesh Bank has rewritten the rules of its Tk20,000 crore factory revival scheme after only about 7 percent of the money had reached borrowers five months in. Banks must now lend their own funds first and seek reimbursement afterward, a reversal of the original upfront funding model, alongside a new name, board level approval requirements and anti fraud declarations. The changes signal how much slack remains in Bangladesh's effort to reopen factories shut by cash flow strain.
Islami Bank Plans a Fivefold Capital Jump to Tk10,000 Crore After a Record Quarterly Loss
Islami Bank's board has approved a plan to raise its authorised capital fivefold, from Tk2,000 crore to Tk10,000 crore, a day after the lender disclosed a Tk1,970 crore loss for July to September, its worst quarterly result in years. The plan still needs clearance from Bangladesh Bank and shareholder approval at an Extraordinary General Meeting before any new shares can actually be issued. Shares fell to Tk21.20 on the announcement, extending a slide that had already pushed the stock below Tk20 earlier in the week. The bank says the higher capital ceiling is part of a broader push to rebuild its balance sheet after losses tied to embezzlement by connected parties on large legacy loans.