Nationwide High Cyber Alert as Outdated Security Systems Raise Risk of Server Takeovers
Hackers keep carrying out cyber attacks on the central banks of many countries around the world. Bangladesh also fears such attacks. So the government’s computer incident response team, BGD e GOV CIRT, has issued an early warning to stay safe. The agency issued the alert yesterday, Thursday, and Bangladesh Bank and some other banks have closed their websites for now to avoid the security risk.
Experts have found two serious security flaws in the PHP programming language. Hackers can use these flaws to enter a website’s server from far away and run harmful commands without any user name or password. This creates a risk that they take control of the website and steal important data. Because of this, BGD e GOV CIRT has issued a high alert about the risk of cyber attacks in the country.
The warning of BGD e GOV CIRT says the two flaws are known as “PHP2Shell”. Their identification numbers are CVE 2026 109618 and CVE 2026 109619. On the international security scoring system, both flaws score 9.2 out of 10. This means they are extremely serious security flaws.
According to CIRT, the risk comes from a problem in the way PHP stores and uses data. A computer keeps some data for a short time while it does a task. If the computer does not clear that data properly after the task, hackers can take advantage of it. They send specially made requests to the website’s server and run their own commands there. The server can then fall into their hands.
Some technologies that run websites with PHP face a higher risk from this flaw. These include PHP FPM, Apache’s mod_php, PHP CGI, FrankenPHP and LiteSpeed. People use these technologies to keep a website running and to show data when users ask for it. Servers that host many websites together, and servers that use technologies like Docker, may also be at risk. So government portals, banks, online shopping sites, and sites built with WordPress and Laravel may come under attack.
A successful attack can cause several kinds of harm. Owners can lose control of the server, and hackers can steal important files and data. The passwords used to enter databases can leak, and websites can stop working. Hackers can also steal the secret keys that websites use to connect with different online services.
CIRT has advised owners to update PHP quickly to a safe version. The safe versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. It is not enough to update only the software used to build the website. Owners must also update the main PHP version running on the server. After that, they must check whether the security fix has started to work.
If owners cannot update right away, CIRT has advised them to limit who can enter the server. They can use a VPN to give access only through a fixed safe connection. They can also block entry from every IP address except the approved ones. They must check the records of the server’s activity on a regular basis. But these steps are only for a short time, and updating to a safe version is the lasting solution.
Bank websites closed
An official of Bangladesh Bank said yesterday that the bank closed its website as part of a worldwide step to stay careful. The bank will open it again after it finishes the risk review.
Bangladesh Bank spokesperson Mr. Arif Hossain Khan said the central bank’s website is closed because of an urgent security problem. The technical experts concerned are working to find and fix the weakness in the website’s security.
