Govt rings alarm over global cyber security flaws

BB downs its website for safety

The national cybersecurity response team has warned of a high risk of hacking and advised government agencies, financial institutions, telecom operators and other organisations to identify vulnerable systems and apply security updates immediately.

Two critical flaws in PHP, software used to run a large share of the world’s websites, could allow hackers to run malicious code on web servers without logging in, said Bangladesh Government Computer Incident Response Team (BGD e-GOV CIRT), which operates under the ICT Division’s Bangladesh Computer Council, in an advisory yesterday.

The warning comes as global firms and governments rushed on Thursday to patch critical flaws in the PHP programming language that underpins much of the internet, as a cloud firm reported millions of hacking attempts after vulnerabilities were disclosed, according to Reuters.

The push came after governments in Europe and elsewhere took websites offline as a precaution on Wednesday while website operators scrambled to secure systems running the software.

The emergency shutdowns of banking, airline, rail, tax and government services from Tokyo to Helsinki mark one of the most dramatic tests of the decades-old programming tools that keep the web running, exposing how deeply governments and companies depend on code that few people understand.

Cloudflare, a company that helps protect websites from cyberattacks, reported millions of attempts to exploit the vulnerabilities following their public disclosure.

As a precaution, Bangladesh Bank (BB), the country’s central bank, has taken down its website since noon yesterday following a global cybersecurity alert, its spokesperson, Arief Hossain Khan, told The Daily Star.

He said the central bank’s IT department was working on the issue but did not say when the website would be restored.

The CIRT advisory states that the flaws could allow an attacker to “execute code on a web server without first authenticating to the application”.

The agency identified government portals, public-facing application programming interfaces (APIs), administrative systems and e-commerce platforms as examples of applications that may be affected.

It urged organisations to “inventory all PHP runtimes and prioritise public-facing systems for immediate patching”, according to the advisory. This means identifying all PHP installations across their systems and prioritising those accessible through the internet for security updates.

According to the CIRT advisory, the two PHP vulnerabilities, collectively known as PHP2Shell, are identified as CVE-2026-109618 and CVE-2026-109619. They could allow attackers to run their own commands on affected servers without first logging in, potentially exposing stored information or disrupting online services.

PHP is a programming language that works behind the scenes of websites, processing requests, retrieving information from databases and delivering content to users. It underpins many online services, including websites built with platforms such as WordPress and Drupal.