Bangladesh's banks restore websites after PHP security concerns

Image- Collected

Bangladesh Bank and dozens of commercial banks have restored their websites after temporarily suspending public access over concerns that attackers could exploit two critical security flaws in PHP, a programming language widely used to operate websites.

The temporary shutdowns affected access to banking websites but did not disrupt internet banking or mobile banking services, according to the central bank.

Bangladesh Bank took its website offline last Thursday and restored it at 8:00 AM on Sunday after completing security checks. Several commercial banks also resumed website operations after taking precautionary measures.

Among the banks whose websites were restored on Sunday were Agrani Bank, Janata Bank, IFIC Bank, Standard Islami Bank, SBAC Bank and Bengal Commercial Bank.

Bangladesh Bank spokesperson Arief Hossain Khan said on Sunday that no bank website had been hacked and that there was no immediate threat to digital transactions. He said the central bank had examined its website for possible vulnerabilities before restoring access.

The website was brought back online on a working day to allow officials to continue monitoring its security, he added. Customers were able to conduct internet and mobile banking transactions as usual throughout the shutdown.

Khan said other banks that had temporarily suspended access to their websites would resume normal operations after completing the necessary security checks.

Taibur Rahman, director general of the National Cyber Security Agency (NCSA), said precautionary measures had helped prevent a potentially serious incident following the discovery of the PHP vulnerabilities. Websites belonging to banks and other organisations were being restored gradually after security assessments, he added.

The shutdowns followed an October 22 advisory from BGD e-GOV CIRT, the government’s cybersecurity incident response team. The advisory urged organisations to identify potentially affected PHP-based systems, install available security updates and inspect server logs for suspicious activity.

The two critical flaws could allow attackers to execute malicious code or unauthorised commands on vulnerable servers, potentially exposing files, databases and other stored information.

A joint advisory issued on October 21 by the European Union Agency for Cybersecurity (ENISA) and other relevant agencies warned that the vulnerabilities could be exploited to run malicious code on affected servers. Organisations were advised to temporarily disconnect vulnerable web applications from the internet if security patches could not be installed promptly.

The security concerns prompted government agencies and commercial organisations in several countries to take precautionary action, including temporarily shutting down websites.

However, the discovery of the vulnerabilities does not mean that every website using PHP has been compromised. The level of risk depends on the software version, whether the relevant security patches have been installed and the effectiveness of other protective measures.

Cybersecurity experts have urged organisations to verify their systems’ security, apply available updates and continue monitoring for suspicious activity even after restoring their websites.

The incident has underscored the importance of securing online infrastructure as banking, pu