Bangladesh Bank kept its official website offline on 24 October 2026, two days after shutting it down as a precaution against critical security vulnerabilities in the PHP programming language. Technical teams were still reviewing the risks, and the central bank said access would be restored once that assessment was complete. A senior official stressed that the shutdown was not an isolated incident, but part of a wider global precautionary response.

Why the shutdown happened

PHP powers a large share of websites worldwide, and the flaws in question could, according to reports cited by the bank's coverage, allow attackers to run unauthorised commands on a server without needing a password. That would put server files, databases and sensitive information at risk. Taking a public-facing site offline while the risk is assessed is disruptive, but it removes the most direct route an attacker could use while patches and checks are completed.

A wider precautionary wave

Several commercial banks in Bangladesh using PHP-based websites also temporarily suspended their online platforms, according to central bank sources. Government institutions and digital services in France, the Netherlands and Belgium took similar preventive steps. Experts cautioned, however, that not every PHP website is vulnerable: the level of risk depends on the specific version in use, the security updates applied, and the server's configuration.

What this means for website owners

The lesson is not to panic, but to verify. Check which PHP version your site runs, apply the vendor's security updates, and confirm the patched version is actually serving requests. For the public, the practical advice is simple: use official apps or verified contact channels while a site is offline, and be wary of lookalike websites or messages claiming to offer a workaround.