Bangladesh’s growing dependence on digital services has come under renewed scrutiny after the government’s cyber security agency warned that several public and private organisations are running outdated or unsupported versions of PHP on their public-facing websites, potentially exposing them to cyberattacks.
The warning follows recent disruptions to the websites of Bangladesh Bank, six commercial banks and the land ministry, which temporarily suspended some online services amid concerns over vulnerabilities in PHP, a widely used programming language for developing websites and web applications.
The Cyber Threat Intelligence (CTI) Unit of Bangladesh e-Government Computer Incident Response Team (BGD e-GOV CIRT) identified the weaknesses through routine monitoring, according to a high-severity alert issued on Saturday.
Despite earlier warnings and advisories, several organisations have yet to respond or confirm that they have implemented the recommended security measures, the alert said.
“Continued exposure of these services without verified security updates may increase the risk of exploitation and compromise,” it added.
The agency did not identify the organisations concerned or disclose the number of websites that remain vulnerable.
The warning came three days after CIRT issued an advisory on October 22 concerning “PHP2Shell”, a set of vulnerabilities that could allow attackers to execute malicious code remotely on affected servers without authentication.
The vulnerabilities could expose sensitive information, compromise servers and disrupt online services.
Researchers have also warned that attackers may be able to access data held in a website’s memory, including passwords, authentication tokens and application programming interface (API) keys.
Banking, land services disrupted
The security concerns have already coincided with disruptions to several digital services in Bangladesh.
Bangladesh Bank restored its website at 8am on Sunday after keeping it offline for two and a half days.
On Saturday morning, the websites of six commercial banks were inaccessible.
The websites of IFIC Bank, Standard Islami Bank and SBAC Bank were restored by Saturday evening, while those of Agrani Bank, Janata Bank and Bengal Commercial Bank remained offline until Sunday, when they were brought back online.
The land ministry also suspended digital services through land.gov.bd for about 36 hours from midnight on October 22 following CIRT’s advisory.
Although the agency’s warning highlights the potential exposure of internet-facing systems, outdated PHP alone does not establish that a website has been compromised.
The actual risk depends on the version being used, the availability of security patches, system configuration and the extent of exposure to the internet.
CIRT identified five principal risks: remote execution of malicious code, unauthorised access to web applications and underlying systems, data theft, service disruption and the use of compromised systems to launch further attacks.
Immediate action urged
CIRT has urged organisations to take immediate steps to secure their internet-facing infrastructure, including checking the PHP versions running on public-facing applications, servers, containers and hosting environments.
It recommended upgrading vulnerable installations to secure releases, applying verified patches and replacing unsupported versions with actively maintained ones.
Organisations unable to install patches immediately should restrict public access through virtual private networks, allow connections only from approved IP addresses or remove unnecessary internet exposure, the alert said.
The agency also advised administrators to examine server logs for suspicious requests, unexpected processes, unauthorised file changes and unusual outgoing connections.
Organisations using managed or shared hosting services should work with their providers to ensure that PHP installations are updated.
However, temporary access restrictions can only reduce exposure and cannot replace the installation of security fixes.
CIRT stressed that organisations remain responsible for securing their applications and infrastructure even when third-party providers host or manage them. Those that have already applied fixes should verify that their live systems are running the updated versions.
“Organisations should not delay remediation until a security incident occurs,” the alert said, urging organisations previously notified of the weaknesses to act without further delay.
Global cyber risk widens
The PHP2Shell vulnerabilities have raised concerns beyond Bangladesh because PHP is widely used to build and operate websites and online services.
As the weaknesses affect PHP itself rather than individual website code, applications may remain exposed even when their developers have followed good coding practices. PHP released emergency security fixes on October 21.
However, a related vulnerability disclosed on October 23 also affects the patched versions and is expected to require another update in a subsequent regular release, according to the earlier report.
Security researchers at Wiz estimate that around 70 per cent of websites worldwide could be affected, underscoring the potential scale of the exposure.
Several European governments have also taken precautionary measures.
Authorities in the United Kingdom, the Netherlands, France, Denmark and Finland have taken some online services offline amid concerns about the vulnerabilities.
The risks highlight the challenges facing governments and businesses as essential services increasingly move online.
Banking, land administration and other public services depend on the availability and security of their digital infrastructure, making timely patching and continuous monitoring critical to preventing disruptions.
For Bangladesh, the latest warning reinforces the need for public and private organisations to verify their systems’ security status, respond promptly to official advisories and ensure that vulnerabilities are addressed before they can be exploited.