Cenbank takes website offline over global cyberattack concerns

Bangladesh Bank's official website went offline this evening (22 October) over security concerns about cyberattacks targeting central banks worldwide, the central bank's spokesperson said. The website remained inaccessible as of 7:30pm.

Arief Hossain Khan, spokesperson and executive director of Bangladesh Bank, said the website had been taken offline as a precaution.

"Central banks around the world are being targeted by hackers, so Bangladesh Bank's website has been taken down as a precautionary measure to protect it from cyberattacks," he said, adding that it would be restored after the necessary security measures were implemented.

PHP flaws prompt shutdowns across multiple countries

The shutdown came amid a global cybersecurity alert over two critical vulnerabilities in PHP, a programming language used by a large share of the internet. Several government, school and hospital websites across Europe and beyond were taken offline on 22 October as organisations rushed to protect their systems.

According to AFP, cybersecurity researchers at Wiz and Calif used artificial intelligence to uncover the flaws. Attackers could exploit them to remotely execute unauthorised commands on servers, potentially exposing files, databases and sensitive information to cyberattacks, data theft and server takeovers.

PHP's developers released security updates, while cybersecurity agencies urged organisations unable to apply the fixes promptly to consider taking affected websites offline. Bangladesh Bank has not directly linked its shutdown to the PHP vulnerabilities.

In Germany, the federal IT service provider ITZBund deactivated several websites as a precaution, with the digital ministry reporting no known security incidents. France's Interior Ministry took prefecture websites offline while awaiting a fix for their PHP framework.

Belgium's foreign ministry also shut down its websites following reports of attacks exploiting the flaws, although its cybersecurity centre said it had recorded no attacks on Belgian websites.

In the Netherlands, organisations following national cybersecurity guidance took numerous websites offline, including those of the Port of Rotterdam, government portal Overheid.nl, football association KNVB, the country's five largest political parties and several hospitals.

Finland's state IT centre Valtori suspended public government web services, reporting no exploitation attempts or data breach. The Czech government also took its website offline to install security patches.

The Wikimedia Foundation, which operates Wikipedia, said its foundation-supported and volunteer-run PHP systems were affected and took several offline pending patches. The Internet Archive temporarily shut down its portal for emergency maintenance, but it has since returned online.

French telecoms group Orange SA suspended access to some websites, services and applications. In Japan, the finance ministry and meteorological agency partially suspended online services, while the National Tax Agency took its service offline. Nomura, Mitsubishi UFJ Financial Group, airline ANA and East Japan Railway also suspended some internet services.

In the United Kingdom, the BBC took down some web portals, as did several municipalities, including Edinburgh.

Security agencies urge urgent patching

The US National Security Agency warned of potential database exploitation, while Britain's National Cyber Security Centre urged organisations to check for attacker backdoors.

PHP is widely used by government institutions, news organisations, e-commerce platforms and private businesses. Many websites in Bangladesh also rely on it, potentially exposing systems running vulnerable versions.

However, identifying a flaw does not necessarily mean a website has been compromised. Administrators have been urged to install the latest PHP security patches or temporarily disconnect vulnerable systems. Users should remain alert to suspicious password-reset notifications and phishing attempts.