Bangladesh Bank takes website offline as cyberattack precaution

Bangladesh Bank took its official website offline on Thursday as a precaution against cyberattacks, with the central bank saying it would be restored once necessary security measures were in place. The site remained inaccessible at 7:30pm. Bangladesh Bank spokesperson and Executive Director Arief Hossain Khan told journalists the decision was taken over an urgent security concern.
“Central banks around the world are being targeted by hackers, so Bangladesh Bank’s website has been taken down as a precautionary measure to protect it from cyberattacks,” he said.
Separately, the government’s Computer Incident Response Team (BGD e-GOV CIRT) has issued a high-level alert over two critical vulnerabilities in PHP, a programming language widely used for websites and web applications. It was not immediately clear whether the central bank’s decision was linked to the PHP flaws or to another security concern involving attacks on central banks.
The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, carry a Common Vulnerability Scoring System (CVSS) score of 9.2, which falls in the critical range. According to the alert, the flaws relate to PHP’s memory management and could allow attackers to execute malicious code remotely without a username or password, potentially taking full control of a server.
Systems considered particularly vulnerable include those running PHP-FPM and Apache’s mod_php. PHP-CGI, FrankenPHP, LiteSpeed, Docker containers and shared-hosting environments may also be at risk, depending on their configuration and exposure. Government portals, banks, e-commerce platforms and websites built on WordPress and Laravel could be affected if they use vulnerable PHP runtimes.
The alert warned that a successful attack could result in server compromise, theft of files and data, exposure of database credentials and API keys, and disruption of online services.
BGD e-GOV CIRT urged organisations to update immediately to the patched versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35, as applicable. It stressed that the underlying PHP runtime on servers must be updated, rather than relying solely on updates to website frameworks or applications.
For organisations unable to patch immediately, the alert recommends temporary safeguards, including restricting server access through VPNs, applying IP-based access controls and increasing log monitoring.
BGD e-GOV CIRT said updating PHP to a secure version remains the only permanent solution.