Bangladesh Bank's Website Stays Dark Through the Puja Holiday as a Global PHP Flaw Keeps Regulators on Edge

If you have tried to open Bangladesh Bank's website this week and found nothing there, you are not looking at a broken link. The central bank took its own site offline on the evening of October 22 as a precaution against a newly discovered, critical flaw in PHP, the software language that runs a huge share of the world's websites, and three days later, through a national holiday, it is still dark.

• Bangladesh Bank's website has been offline since the evening of October 22
• The cause is "PHP2Shell," two critical, unauthenticated remote code execution flaws in PHP itself
• The bank says it could restore the site but is choosing not to while the global risk persists
• BSEC, the Dhaka Stock Exchange, IDRA and the Financial Institutions Division have all kept their sites running
• There is no evidence the flaw has touched any customer account, mobile banking app or payment system

What actually happened

Bangladesh's government cybersecurity agency, BGD e-GOV CIRT, flagged the PHP vulnerabilities on October 22, a day after PHP's own developers rushed out emergency patches. Bangladesh Bank took its website offline that same evening, purely as a defensive move. By Saturday, October 24, the central bank's Executive Director, Arief Hossain Khan, confirmed to bdnews24.com that the outage was not an accident and would not be ending on the bank's original timeline.

"We are prepared to bring it back online, but the risks remain," Khan said, adding that the bank's IT team was on "high alert."

The timing made the disruption worse than it might otherwise have been. Bangladesh Bank had planned to restore the site once the country's five day Durga Puja holiday ended on October 25. That plan is now on hold, with no fixed date for when the site will reappear.

What PHP2Shell actually is

For anyone who has never had reason to think about the software running underneath a website, here is the short version. PHP is a programming language that powers a very large share of the internet, including many government and financial sites, often without visitors ever knowing it is there. Researchers discovered that two flaws in PHP itself, nicknamed "PHP2Shell," could let an attacker run commands on a vulnerable server without logging in at all, potentially letting them steal data, deface a site, or take it over completely.

This is not a Bangladesh specific problem, and it is not something Bangladesh Bank did wrong in building its own site. Security researchers at Wiz demonstrated the attack against widely used platforms including WordPress, Drupal and Joomla, and found they could read passwords straight out of a server's memory. Palo Alto Networks' threat research unit counted more than 22 million internet-exposed systems that could be vulnerable worldwide. In the United States, the NSA, FBI and CISA all urged organisations to patch immediately or take affected systems offline, and government agencies across Europe did exactly that as a precaution, the same choice Bangladesh Bank made.

Why some regulators stayed up and others didn't

Not every Bangladeshi financial regulator made the same call. The Bangladesh Securities and Exchange Commission, the Dhaka Stock Exchange, the Insurance Development and Regulatory Authority, and the Financial Institutions Division have all kept their websites running throughout. That does not necessarily mean those sites are immune. It more likely reflects differences in how each one is built, how exposed its particular software setup is to this specific flaw, and each organisation's own appetite for risk. Bangladesh Bank, as the institution that supervises the entire banking system and holds the country's foreign exchange reserves, has historically taken an especially cautious line on anything resembling a cyber threat.

What it means for your money

For ordinary account holders, there is a practical question buried under the technical one: does any of this put your money at risk? Based on what has been reported so far, the answer is no. The outage affects Bangladesh Bank's public website, which carries notices, data, publications and press releases, not the core banking infrastructure that moves money between accounts. Mobile banking apps, card payments and the Bangla QR system run on separate systems operated by individual banks and payment providers, and there have been no reports of those being disrupted or compromised. CISA said, as of its last update, that it had not observed active exploitation of the PHP2Shell flaw, though independent researchers expect opportunistic attacks to follow now that the vulnerability is public knowledge.

Still, this is a reasonable moment for some basic digital hygiene. Avoid clicking links in unsolicited emails or texts claiming to be from Bangladesh Bank or your own bank, since scammers often exploit news of a cyberattack to run fresh phishing campaigns. If you need official exchange rate data, circulars or other information that would normally come from the Bangladesh Bank website, your own bank's branch or its mobile app remains a reliable channel in the meantime.

What happens next

Bangladesh Bank has not given a timeline for restoring its website, and Khan's comments suggest the bank is treating this as an open-ended precaution rather than a short outage with a fixed end date. The broader PHP flaw is likely to keep making headlines well beyond Bangladesh. With patches now available, the window for institutions to protect themselves is open, but so is the window for attackers racing to find systems that have not yet applied them. Until Bangladesh Bank's IT team is satisfied that risk has eased, the country's central bank will keep functioning exactly as it has all week, just without a public website to show for it.