PHP flaw trickles down to service disruptions

Bank, govt websites taken down out of precaution in Bangladesh

Disruptions in digital services in Bangladesh have been reported after a critical security flaw in PHP, one of the world’s most widely used web programming languages, prompted some banks and government agencies to take their websites offline as a precaution.

Industry insiders said the full extent of the service disruption would become apparent today, as offices reopen after the five-day  Durga Puja holiday.

Bangladesh Bank has kept its website down since Thursday, while Agrani, Janata and Bengal Commercial banks’ websites were offline as of 5:00pm yesterday.

IFIC, Standard Islami and SBAC’s sites were back online apparently after their systems were patched.

The land ministry also suspended its digital land services (land.gov.bd). It had announced that the work on its systems was to run for 36 hours, from midnight on Thursday to noon on Saturday, during which no land-related digital services could be availed.

A notice on the portal says the work follows the urgent cyber alert issued by BGD e-GOV CIRT, the government’s cyber security agency, on October 22.

It asked people not to make any payments after 11:45pm on Thursday. The notice was still on the portal on Saturday evening, after the stated deadline.

BGD e-GOV CIRT’s alert asked organisations to identify where PHP is used on their servers, check whether the versions they run are vulnerable and take the necessary security measures.

PHP is a programming language used for building websites and web applications, including many sites that run on WordPress.

The reported security flaw, known as “PHP2Shell”, could allow hackers to take control of vulnerable websites.

The flaw involves two security vulnerabilities that can let attackers remotely run malicious code. Researchers have also warned that attackers may be able to access sensitive information stored in a website’s memory, including passwords, authentication tokens and API keys.

Security researchers at Wiz estimate that the vulnerabilities could affect around 70 percent of websites across the globe.

The key protection is to install the security updates released by PHP and check that the website’s server is running a patched version. Website operators should also review their systems for signs of unauthorised access.

PHP released emergency fixes on October 21. However, a related vulnerability was reported on October 23 and also affects these patched versions. The PHP team is expected to address it in a subsequent regular release.

The vulnerabilities, which emerged on Wednesday, caused governments and companies to pull their websites off the internet and patch them before being potentially attacked.

In the UK, 32 government services had been taken offline, the cybersecurity minister, Liz Lloyd, told parliament. Dutch, French, Danish, and Finnish governments also took sites offline.

So far, there have not been any breaches.

The vulnerability lies in PHP itself, not in website code, leaving even well-coded websites at risk, said Tanvir Hassan Zoha, associate professor at the Department of Cyber Security and Digital Forensics at Daffodil International University.

Bangladesh has no published data on how many government websites run on PHP.

Based on global trends and the widespread use of PHP-based tools, Zoha estimated that between 60 and 85 percent websites could be vulnerable.

He recommended that authorities immediately compile a list of PHP versions running on government servers, prioritising those exposed to the internet, and update them with patched versions.

“Some systems in Bangladesh are so old that you cannot update the server,” said Atiqul Islam Khan Shawon, chief executive officer of SoftBD, adding that about 5 percent will have a problem.

Using a news website as an example, he said systems built five or 10 years ago may face trouble because it is uncertain whether they will keep working after the version is updated.

But for those that are regularly updated, there will be no challenge, he said.

Asked how many websites in Bangladesh use PHP, he said, “You can say more than 70 percent -- the e-commerce sites mostly use PHP.”

As PHP 8.1 and older versions no longer receive official updates, the authorities may need to use patched packages provided by Linux distributions or migrate to newer versions, according to Zoha.

Until the updates are completed, firewalls should be used as a temporary safeguard, while websites that cannot be secured should be taken offline.

The authorities should also review server logs from recent days for suspicious requests, and the Bangladesh Government’s e-Government Computer Incident Response Team (BGD e-GOV CIRT) should issue coordinated instructions with clear deadlines, said Zoha, also an additional attorney general.

Muhammad Anwar Uddin, project director at Aspire to Innovate (a2i), which has built and runs thousands of government websites, said they had not experienced any cyberattacks related to the PHP vulnerability.

“We received the alert early, and our technical team was fully alert,” he said, adding that the team was working on the necessary updates and had almost completed the process.

Without proper maintenance and regular patching, these systems develop vulnerabilities, said an ICT expert who previously worked at a2i.

The government spends heavily on visible items such as capacity development and training, while the invisible work of securing infrastructure gets little long-term budget or attention.

Efforts to fix systems typically begin only after a major data leak or cyber attack, he said, while calling for security to be built into every stage of a system, from design through operation, and for software and servers to be patched regularly.

“Alongside strong laws, we need updated infrastructure and the capacity to respond quickly. An outdated server does not wait for the law,” said Zoha, also a prosecutor at the International Crimes Tribunal.

Shawon’s main advice is to keeping the websites up-to-date with proper maintenance.

“Many treat it as a one-time purchase and do not keep the upgrades going with the IT firm. Continuous upgrades are important. Then there is no problem,” he said.