BB website down amid global cyberattack concerns

The Bangladesh Bank took its official website offline on Thursday evening as a precautionary measure amid growing concerns over cyberattacks targeting central banks worldwide.

As of 8:25pm on 22 October, the website remained inaccessible.

Arief Hossain Khan, spokesperson and executive director of the central bank, told journalists that the website had been taken offline due to an urgent security concern.

“Central banks around the world are being targeted by hackers, so Bangladesh Bank’s website has been taken down as a precautionary measure to protect it from cyberattacks,” he said.

The website will be restored after the necessary security measures have been taken, he added.

This move came as the Bangladesh government’s Computer Incident Response Team (BGD e-GOV CIRT) issued a high-level security alert over two critical vulnerabilities in PHP, a widely used programming language for websites and web applications.

The vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619, have a reported Common Vulnerability Scoring System (CVSS) score of 9.2, indicating a critical level of risk.

According to the alert, the flaws are related to PHP’s memory management and could allow attackers to execute malicious code remotely without requiring a username or password.

The vulnerabilities could expose affected servers to unauthorised access and potentially allow attackers to take full control of a server.

The warning has implications for government portals, banks, e-commerce platforms and websites built on WordPress and Laravel that use vulnerable PHP runtimes.

A successful attack could result in server compromise, theft of files and data, exposure of database credentials and API keys, and disruption of online services.

BGD e-GOV CIRT has urged organisations to update their PHP installations immediately to the patched versions: 8.5.12, 8.4.27, 8.3.36 and 8.2.35, as applicable.

However, it was not immediately clear whether Bangladesh Bank’s decision to take its website offline was directly linked to the newly reported PHP vulnerabilities or to a separate security concern involving attacks on central banks.