Portal Reopened Following Comprehensive Security Review Amid Global PHP Engine Flaw
Bangladesh Bank Restores Official Website After Four-Day Precautionary Outage
- Central bank portal remained offline for 96 hours to audit server infrastructure and eliminate attack vectors
- Precautionary measures followed global alerts on unauthenticated PHP remote code execution vulnerabilities
- a2i confirms 36,500 public sector portals remain insulated as European agencies deploy parallel safeguards
Following an extensive four-day offline maintenance and vulnerability audit triggered by heightened global cyber alerts, the official website of Bangladesh Bank has been restored to public operation. Access to the central bank's digital interface was fully normalized at 8:00 AM on Sunday, 25 October 2026.
Bangladesh Bank Spokesperson Arif Hossain Khan confirmed the development, clarifying that the portal had been taken down intentionally since Thursday as an emergency security measure. He explained that following detailed threat modeling, code patching, and risk-assessment validations, the web servers were deemed secure and cleared for public traffic.
Commencing the evening of Thursday, 22 October, external traffic to the regulator's portal was redirected to a standard maintenance splash page displaying an administrative downtime advisory.
Technical teams familiar with central bank IT operations indicated that systems engineers and cybersecurity specialists were mobilized to audit code dependencies following the global disclosure of high-severity flaws in the core PHP engine. Multiple commercial financial institutions across Bangladesh operating PHP-backed customer gateways also placed their digital web assets under temporary offline maintenance as a defensive protocol.
The disclosed vulnerabilities in the PHP runtime allow unauthenticated remote threat actors to execute arbitrary commands without administrative passwords, creating severe avenues for server hijacking, backend database exfiltration, and data manipulation. The severity of the flaw has driven governmental agencies across France, the Netherlands, and Belgium to initiate similar defensive quarantines and out-of-band server mitigations.
Meanwhile, representatives from the government's Aspire to Innovate (a2i) program reiterated that approximately 36,500 state and ministerial websites hosted under the central National Portal Framework do not run on PHP architecture, leaving core administrative portals immune to this specific vector, official sources confirmed.
//DBTech/ASO/SME/MVNO//
