Bangladesh Sounds Urgent Hacking Alert Over Critical PHP Flaws

⚠ Bangladesh's national cybersecurity response team has warned of a high risk of hacking and advised government agencies, financial institutions, telecom operators and other organisations to identify vulnerable systems and apply security updates immediately. The alert places the country's digital infrastructure on emergency footing at the same moment governments and corporations worldwide are scrambling to contain one of the most serious web-software vulnerabilities disclosed in recent years.

🗝 Two critical flaws in PHP — the programming language used to run a large share of the world's websites — could allow hackers to run malicious code on web servers without logging in, said the Bangladesh Government Computer Incident Response Team (BGD e-GOV CIRT), which operates under the ICT Division's Bangladesh Computer Council, in an advisory. The two vulnerabilities, collectively known as PHP2Shell, are tracked as CVE-2026-109618 and CVE-2026-109619.

🌏 The warning comes as global firms and governments rushed on Thursday to patch the critical flaws in the software that underpins much of the internet, after a cloud-security firm reported millions of hacking attempts following the vulnerabilities' public disclosure, according to Reuters. Governments in Europe and elsewhere had taken websites offline as a precaution on Wednesday while website operators scrambled to secure systems running the software.

🚨 The emergency shutdowns of banking, airline, rail, tax and government services from Tokyo to Helsinki mark one of the most dramatic tests of the decades-old programming tools that keep the web running, exposing how deeply governments and companies depend on code that few people understand. Cloudflare, a company that helps protect websites from cyberattacks, reported millions of attempts to exploit the vulnerabilities after their disclosure — a measure of how quickly opportunistic attackers move once a flaw becomes public knowledge.

🏦 Bangladesh Bank takes its website down

📱 As a precaution, Bangladesh Bank (BB), the country's central bank, has taken down its website since noon following the global cybersecurity alert, its spokesperson Arief Hossain Khan told The Daily Star. The central bank's IT department was working on the issue, the spokesperson said, while declining to indicate when the website would be restored — an unusual step for the institution at the heart of the country's financial system, and one that underscores the severity of the threat.

🔍 The CIRT advisory states that the flaws could allow an attacker to execute code on a web server without first authenticating to the application — meaning any attacker who reaches a vulnerable server can potentially take control of it directly. The agency identified government portals, public-facing application programming interfaces (APIs), administrative systems and e-commerce platforms as examples of applications that may be affected.

🧱 It urged organisations to inventory all PHP runtimes and prioritise public-facing systems for immediate patching — in plain terms, identifying every PHP installation across their systems and rushing security updates first to those accessible from the internet. PHP works behind the scenes of websites, processing requests, retrieving information from databases and delivering content to users, and it underpins many online services, including websites built on popular platforms such as WordPress and Drupal.

🛡 Why this matters for Bangladesh's digital economy

💰 The stakes are particularly high for Bangladesh, where PHP-based platforms power a large share of government portals, bank websites, e-commerce storefronts and news sites. A successful unauthenticated exploit could expose citizen data stored in government databases, disrupt online banking services or deface public-facing platforms — reputational and operational damage that would be especially painful for a financial sector still rebuilding confidence after previous high-profile cyber incidents.

💻 For the country's fast-growing digital economy — from mobile financial services to the freelancing and ITES export sectors — the episode is a stress test of basic cyber hygiene. Security practitioners have long argued that patch discipline, asset inventories and layered defences matter more than any single product, and the PHP2Shell episode proves the point: the organisations that knew exactly which systems run which software versions are the ones that could act within hours.

🚀 The speed of the global response — websites voluntarily taken offline, patches deployed within a day, exploit attempts tracked in real time by cloud-security firms — reflects how much the internet's security posture has improved since the era of slow-moving worms. But it equally reflects how fragile the foundation remains: one bug in a language most internet users have never heard of was enough to force precautionary shutdowns of rail bookings and tax portals on two continents.

🔭 For Bangladeshi organisations, the immediate task is clear: complete the PHP inventory, apply vendor patches, verify restoration of any service taken down, and report incidents to BGD e-GOV CIRT. The longer-term task is harder — building the institutional muscle, from security operations centres to routine vulnerability scanning and bug-bounty programmes, that turns each global alert from an emergency into routine maintenance. Institutions that invest in that muscle now will find the next alert far less costly than this one has been.