Central Bank Website Stays Dark as Bangladesh Weighs Precautions Against Global PHP Cyber Flaws
The central bank says the precautionary shutdown is not linked to any confirmed breach, while banking operations and inter-bank payments continue normally.
Bangladesh Bank has kept its public website offline for multiple consecutive days as part of a deliberate security precaution triggered by a global alert over critical vulnerabilities in the PHP programming language. The central bank removed the site from public access on Thursday, 22 October, after receiving warnings about the newly disclosed flaws, and the outage has continued through Friday and into Saturday without a firm date for restoration.
Anyone trying to reach the official site is greeted by a standard maintenance message explaining that the service is temporarily unavailable and will return once work is complete. Spokesperson and Executive Director Arief Hossain Khan has repeatedly stated that the move is purely preventive. No evidence has been presented of an actual breach or data compromise at the central bank itself. Instead, the institution is using the downtime to verify its systems, apply relevant patches, and confirm that residual risks have been adequately reduced before reopening the site to the public.
The vulnerabilities in question were identified with the help of artificial-intelligence tools by cybersecurity researchers and later publicised more widely. Although developers released fixes, details of the flaws circulated before many organisations could complete their updates, prompting a wave of caution across financial institutions, government agencies, and large companies worldwide. PHP underpins a substantial portion of the internet's websites, including numerous platforms used by banks and regulators, which has amplified concern about potential remote-code-execution risks.
For Bangladesh's business community the practical impact has so far been limited but noticeable. Core banking operations and the electronic connections between Bangladesh Bank and commercial banks continue to function normally, so payment settlements, inter-bank transfers, and routine regulatory reporting have not been interrupted. However, companies, journalists, researchers, and members of the public who normally download circulars, statistical releases, or policy documents from the central bank's website have had to turn to alternative channels or wait for direct communication from the bank. Some market participants have described the temporary inconvenience as manageable yet a reminder of how dependent daily commercial activity can become on uninterrupted access to official digital platforms.
The episode also sits against a backdrop of heightened cybersecurity awareness in Bangladesh's financial sector. Institutions have been urged by government computer-incident response teams to review their own web-facing systems and prioritise patching. Bangladesh Bank's decision to stay offline longer than a brief maintenance window reflects a conservative posture: restore service only after internal teams are satisfied that the public-facing layer is secure. Officials have declined to offer a precise restoration timetable, emphasising that thorough verification takes precedence over speed.
Business associations and corporate treasurers are monitoring the situation mainly for any secondary effects on information flow rather than for disruptions to payments. In the short term, the continued outage is expected to remain an operational footnote rather than a market-moving event, provided the underlying banking infrastructure stays stable. Over the longer term, the incident is likely to feed into broader discussions about the resilience of public digital infrastructure and the speed with which critical patches can be deployed across the country's financial network.
As of Saturday, 24 October, the website remains inaccessible while security work continues. Once the bank is confident that the identified risks have been addressed, the site is expected to return with its usual range of circulars, data portals, and public notices. Until then, the temporary shutdown stands as a clear illustration of how a single global software vulnerability can prompt even central banks to pause public digital services in the interest of caution.