Old PHP Flaw Triggers Website Shutdowns Worldwide, Halting Land Services and Bank Sites in Bangladesh

A serious security flaw in PHP has been discovered worldwide, and websites are shutting down one after another — a wave that has now reached Bangladesh. After an urgent cyber alert, the websites of several government and private institutions in the country, including land services and Bangladesh Bank, have been kept closed so their security can be updated.

About three hundred thousand people in the country take online land mutation services every month. On Saturday, people trying to use the e-mutation service found it closed. The mutation website says it is being updated as part of the BGD e-GOV CIRT urgent cyber alert, and that is why land services are suspended.

Sources at BGD e-GOV CIRT, the agency in charge of the government's cyber security, said the alert was issued after a PHP security flaw was found worldwide. Because of the flaw, websites have been closed around the world. In Bangladesh too, alongside land services, the websites of Bangladesh Bank, several government and private banks, private hospitals and other institutions have been kept closed.

By keeping their websites closed, the institutions are improving their security systems. However, CIRT sources said they have received information that at least one hospital's website in the country was attacked. On the other hand, no institution is admitting that it closed its website because of the PHP flaw, so it is not known how many institutions in Bangladesh are in difficulty.

Asked whether the land service website was closed because of the PHP flaw, Asif Mahmud, deputy project director of the Land Management Automation Project, said an issue is being examined with the Bangladesh Computer Council as part of regular maintenance, the site has been kept closed for that reason, and it is a temporary measure. The site is scheduled to remain closed until 12 noon on Sunday, but it will be reopened earlier if the work finishes sooner, he said. The notice on the website itself, however, speaks of updating as part of CIRT's urgent cyber alert.

Many internet users may never have heard the name PHP, yet they interact with it constantly. PHP is short for Hypertext Preprocessor — a programming language that works in the back end, behind the scenes. A BBC report on Friday, citing the cyber security firm Wiz, said 70 percent of all websites in the world are run with PHP. Canadian programmer Rasmus Lerdorf created it in the 1990s and made the source code open for everyone.

This flaw had existed in PHP for more than a decade, but it had not been detected until now. Last week, a team of researchers from two US cyber security firms identified it with the help of artificial intelligence — the firms are Calif and Wiz, of which Wiz is a company of Google's parent Alphabet. Calif researcher Ryan Austin said it is the most serious flaw he has ever identified.

Once news of the security flaw leaked, hackers began trying to use it to seize control of websites and steal data, and concern began worldwide. The US National Security Agency warned all PHP-using organisations on October 21 that if an organisation cannot fix the flaw quickly, it should shut its system down, because the flaw could create an opportunity to attack a database directly.

The BBC says that after the warning, various online services including gaming platforms, government websites and online forums were disrupted. Wikimedia, which runs Wikipedia, shut down several of its systems as a precaution. The UK government said on Thursday that it had closed 32 websites as a precaution. French telecom firm Orange kept access to certain services closed worldwide while fixing the flaw, the Finnish government also closed some websites and pages, some BBC pages were kept closed, and the Netherlands' cyber security agency shut down its own website.

Meanwhile, a hacker group claimed to have taken control of confidential customer information of India's main bank, the State Bank of India, and on Friday the state-owned bank admitted a leak of customer data. Although hundreds of websites have closed worldwide, no institution has yet said how much the financial loss is or how many websites have closed in total. Updating PHP, however, has been identified as the way to reduce the risk.

BGD e-GOV CIRT issued its urgent alert on PHP on Thursday, October 22. It advised concerned institutions to identify the use of PHP on their servers, check whether the versions in use are risky, and take necessary security measures. CIRT project director Nazmul Haque Khandkar said that after the advisory, websites hosted at the National Data Center and institutions under the National Portal Framework were informed, and critical information infrastructure institutions were also warned.

After the urgent alert, Bangladesh Bank has kept its website closed since Thursday. Following the central bank's move, Agrani Bank, Janata Bank, IFIC Bank, Standard Islami Bank, SBAC Bank and Bengal Commercial Bank also closed their websites as a precaution. The banks said the measure is part of avoiding possible cyber risk and verifying the security of their technology infrastructure, and the websites will reopen once the security checks are complete. Bangladesh Bank executive director and spokesperson Arif Hossain Khan said the website has been kept closed as part of caution, technology officials are working round the clock, banking services have not been affected, and the website will reopen once the risk subsides.

Leaks of citizens' personal data have now become a common occurrence in Bangladesh. An August report by the technology research organisation TechGlobal Institute says at least 68 data leak incidents occurred in Bangladesh from January 2023 to May 2026 — 36 of them government and 32 private institutions. The National Identity Registration database was leaked in February last year, and in 2023 the NID data of five crore people was also leaked, with the report noting that no action was taken over those incidents.

Asked whether the PHP flaw is worrying for Bangladesh in such a situation, Professor B M Mainul Hossain of Dhaka University's Institute of Information Technology said it is certainly worrying — raising the question of what would happen if someone took control of the land service server and altered land records, or seized the income tax site and deleted its data. Bangladesh must stay alert, he said, and ensure security at home by watching what measures are being taken worldwide. All eyes are now on Sunday noon — whether the closed websites, including land services, return on schedule.