MediumII Cyber Warfare & Critical Infrastructure26 October 2026, Monday
Bangladesh takes its 440-service myGov portal offline over a PHP flaw
Bangladesh's one-stop e-government portal myGov has been placed under emergency maintenance because of flaws in PHP-based systems. The portal carries 440 public services. The shutdown follows a week in which the central bank's site was down for 2.5 days and the land ministry's for 36 hours.
The Daily Star reported on 27 October that a2i, the operator of myGov, had put the portal into emergency maintenance for security and service quality, with the work running until midnight on 27 October. Asked about the link to the PHP flaws, a2i project director Muhammad Anwar Uddin said some such problems had been found, but that 1 part of the systems runs outside PHP. Bangladesh's e-Government CIRT had issued a warning on 22 October about PHP vulnerabilities that let attackers run code remotely on a server without logging in.
Sources differ on when the shutdown began. The Daily Star writes that the portal went down on 26 October. TOB News, in a report published on the night of 26 October, said the site had been offline for 2 days. TOB News quotes an official saying the flaws could be fixed by Tuesday 27 October. The same report says about 80% of the sites built in the country over the past 20–25 years run on PHP.
The same wave hit the financial sector. The Daily Star reports that Bangladesh Bank's site came back at 08:00 on the morning of 26 October after roughly 2.5 days offline; on 24 October 6 banks including Agrani and Janata went offline. The land ministry suspended land.gov.bd services for about 36 hours from midnight on 22 October. CIRT stressed that running an old PHP version does not on its own mean a site has been attacked.
Talay assessment
Bottom line
Rather than wait for a patch against the PHP flaw, Bangladesh is taking critical sites down one after another. That lowers the risk of a data leak while imposing outage costs on public services and banking. The most likely route is a phased end to the shutdowns within a few days, with a wide band of legacy systems still exposed.
Likely effects
- Public servicesNegativeWeeks
Citizens and firms waiting on document approvals and licences face delays in overseas applications while 440 services are suspended.
- Confidence in bankingNegativeWeeks
The central bank and 6 banks going offline weakens trust in digital banking and the continuity of transactions.
- Regional cyber riskUncertain1–6 months
The same PHP flaw threatens other public and financial sites across Asia; Bangladesh's shutdown reflex could set a regional precedent.
Possibilities, ranked
- 1Phased reopening60%
myGov and its subdomains are patched and brought back online in stages within a few days.
Watch: a2i announcing that myGov is fully back in service
- 2Shutdowns drag on30%
Because old PHP versions are widespread, other ministry and bank sites go offline in turn.
Watch: A new list of institutions from CIRT or further shutdown reports
- 3A leak surfaces10%
One of the sites taken down turns out to have been exploited before the warning.
Watch: A data breach statement from CIRT or a2i
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Public services halted▼ 440
- Banks taken offline▼ 6