Central Bank Goes Dark as National Alert Highlights Critical PHP Flaws

Bangladesh Bank has taken its public website offline while the country's computer emergency response team warns of severe vulnerabilities in PHP that could let attackers seize control of affected servers. The temporary suspension is a defensive step taken amid a global security advisory, not the result of a confirmed intrusion at the central bank itself.

The Bangladesh Government's Computer Incident Response Team (BGD e-GOV CIRT) has issued a high-priority notice covering two flaws, tracked as CVE-2026-10968 and CVE-2026-10969. Analysts have characterised them as "PHP-to-Shell" weaknesses. Once successfully exploited, the flaws can allow an attacker to run commands on a web server, potentially opening the door to deeper access, data extraction, or the installation of persistent malware. Because PHP underpins a large portion of websites, content management systems, and online services worldwide, the exposure is broad and not confined to any single nation or industry.

Financial institutions face particular pressure in such situations. A central bank's website may not host the core payment or settlement systems, yet it still handles public information, forms, and links that users trust. Leaving it exposed while a widely publicised vulnerability remains unpatched creates unnecessary risk. Taking the site offline buys time for technical teams to apply patches, verify configurations, and scan for signs of compromise before restoring normal service.

The alert lands in a climate already marked by repeated cybersecurity lapses in Bangladesh. Government portals have previously remained compromised for months after attackers claimed to have extracted and published sample databases. These episodes have illustrated slow patch cycles, incomplete asset inventories, and limited continuous monitoring across parts of the public sector. Private companies and smaller organisations often face the same constraints with fewer resources. Each new high-severity disclosure therefore tends to surface the same underlying weaknesses rather than isolated one-off failures.

For organisations still running vulnerable versions of PHP, the practical response is straightforward but urgent. Official patches should be applied as soon as they are released by the PHP maintainers or by the vendors of the software packages that embed PHP. Where immediate patching is not possible, temporary measures can reduce exposure: disabling unnecessary PHP functions, restricting web server access to trusted networks, enabling stricter firewall rules, and increasing the intensity of log monitoring for unusual command execution or outbound connections. Systems that handle sensitive personal or financial data should be prioritised.

The global dimension of the threat means Bangladesh is not acting in isolation. Similar advisories have prompted website operators and cloud providers in multiple countries to restrict or temporarily disable services while fixes are rolled out. The difference lies in the speed and completeness of the response. Institutions that maintain current inventories of their web applications and automated patching processes can close the window of risk more quickly than those that rely on manual reviews.

No public statement has yet confirmed that attackers successfully exploited these specific PHP flaws against Bangladesh Bank or other major Bangladeshi institutions. The central bank's decision to go offline is therefore best read as precautionary risk management. Restoring the site will depend on completing technical remediation and confirming that no residual compromise exists.

The episode adds to a longer list of reminders that widely used open-source components can become systemic risks when updates lag. For Bangladesh's financial sector and government agencies, the immediate task is to close the known holes. The longer-term task is to shorten the gap between the public disclosure of a critical flaw and the moment it is fully mitigated across critical systems. Until that gap narrows, similar high-alert notices and temporary service disruptions are likely to recur.