Bangladesh Websites Still Vulnerable to PHP2Shell Despite Warnings: CIRT

⚠ Several government and private organisations in Bangladesh are still using outdated or unsupported versions of PHP — the programming language widely used to build websites — potentially leaving their public-facing online services vulnerable to cyberattacks, the government's cyber security agency has warned. The Cyber Threat Intelligence (CTI) Unit of Bangladesh e-Government Computer Incident Response Team (BGD e-GOV CIRT) identified the weaknesses through routine monitoring, according to a high-severity alert issued yesterday.

📢 The frustration in the official language is barely veiled: despite earlier warnings and advisories, several organisations have yet to respond or confirm that they have taken the necessary security measures. Continued exposure of these services without verified security updates may increase the risk of exploitation and compromise, the alert said. The agency did not name the organisations or disclose how many websites remain vulnerable — discretion that will either protect reputations or shelter laggards, depending on what happens next.

🗳 The warning came three days after CIRT's October 22 advisory on PHP2Shell, the set of vulnerabilities that could allow attackers to run malicious code on servers remotely without logging in — exposing sensitive information, compromising servers and disrupting online services. CIRT identified five potential risks: attackers running malicious code remotely, gaining unauthorised access to web applications and underlying systems, stealing data, disrupting services, and using compromised systems to launch further attacks.

ℹ The agency was careful to calibrate the risk: running an outdated PHP version does not necessarily mean a system has been attacked, since actual risk depends on the version in use, whether security patches have been applied, how the system is configured and how exposed it is to the internet. But it urged organisations to take immediate steps to secure internet-facing systems: check which PHP versions are running on public-facing applications, servers, containers and hosting environments; upgrade vulnerable versions to secure releases; apply verified patches; and replace unsupported versions with ones still maintained.

🔒 For those unable to install patches immediately, CIRT prescribed containment: restrict public access through virtual private networks, allow connections only from approved IP addresses, or remove unnecessary internet exposure — while stressing that temporary access restrictions reduce risk but cannot replace security updates. Organisations should also check server logs for suspicious requests, unexpected processes, unauthorised file changes and unusual outgoing connections; those using managed or shared hosting should work with their providers to ensure PHP is updated; and those that have already applied fixes should verify their live systems are running the updated versions. Organisations should not delay remediation until a security incident occurs, the alert said pointedly, urging recipients of earlier notifications to act without further delay. Responsibility for securing applications remains with each organisation even when third parties host or manage them.

📈 The damage already done

🏦 The vulnerability has already disrupted digital services across the country. Bangladesh Bank restored its website at 8am yesterday after keeping it offline for two and a half days. On Saturday morning, the websites of six banks were offline — IFIC Bank, Standard Islami Bank and SBAC Bank were back by evening, while Agrani Bank, Janata Bank and Bengal Commercial Bank remained dark until Sunday. The land ministry also suspended digital services on land.gov.bd for about 36 hours from midnight on October 22, following the CIRT advisory.

🧠 The technical particulars explain the urgency. The PHP2Shell vulnerabilities could allow attackers to run malicious code on affected servers without authentication, and researchers warn that attackers may be able to access data stored in a website's memory — including passwords, authentication tokens and API keys. Because the flaw affects PHP itself rather than individual website code, applications could remain at risk even where developers followed good coding practice — the rare vulnerability class where craftsmanship buys no protection. PHP released emergency fixes on October 21, yet a related vulnerability disclosed on October 23 also affects those patched versions and will require another update in a subsequent regular release. Security researchers at Wiz estimate around 70 percent of websites worldwide could be affected, and governments in the United Kingdom, the Netherlands, France, Denmark and Finland have taken online services offline as a precaution.

🔭 The governance lesson compounding the technical one

📚 For Bangladesh, the striking part of this alert is not the existence of the flaw — every country shares that — but the silence it documents: organisations notified by their national CERT days ago that still had not responded or confirmed fixes by a public high-severity alert. That gap is the country's real vulnerability posture in miniature: detection capability that works, patch discipline that lags. Each organisation that treats a CIRT advisory as informational reading rather than an action deadline converts a global software problem into a local institutional one.

🗂 The accountability question now follows naturally: whether BGD e-GOV CIRT will escalate — naming non-compliant organisations, coordinating with parent ministries, or requiring certified remediation reports — or whether the cycle of advisory-then-ignoring repeats when the next flaw surfaces. The country has just watched a week in which the central bank and six commercial lenders preferred days of darkness to unverified exposure; the organisations still running unsupported PHP are gambling that obscurity is protection. The alert's closing warning, that remediation must not wait for an incident, is addressed to them — and the next week's data will show whether it landed.