Bangladesh's central bank pulls its website over PHP flaw fears

The Business Standard reported at 19:30 Dhaka time on 22 October that the shutdown was a precautionary decision driven by concern over attacks on central banks worldwide. Bank spokesman and executive director Arif Hossain Khan said the IT department was working to close the flaws and gave no reopening timetable. Prothom Alo says internet and mobile banking ran normally on 22 October and no problems with customer transactions were reported. Nor was any evidence made public that the bank's own site had been attacked.

Behind the decision are 2 PHP flaws that, according to AFP, researchers at Wiz and Calif found with the help of artificial intelligence; they allow an attacker to run unauthorised commands on a server. Prothom Alo writes that PHP powers about 70% of the world's websites and that many institutions have taken their sites down since the night of 21 October. TBS's round-up shows Germany's federal IT provider ITZBund, Japan's finance ministry and National Tax Agency, and at least 4 Japanese companies also restricted services. The US National Security Agency warned that databases could be exploited, and Britain's National Cyber Security Centre asked organisations to scan for backdoors.

The picture in Dhaka also sends 2 inconsistent messages. One outlet reported seeing a scheduled-maintenance notice on the site, while the bank publicly cited a security measure. The Bangladesh Securities and Exchange Commission and the Dhaka Stock Exchange kept their websites up on 22 October. TBS points out that many public websites in Bangladesh run on PHP and that unpatched versions remain exposed; how many have been patched could not be verified.