A global security warning has raised concerns about websites running PHP software. Officials have not confirmed a related major cyberattack in Bangladesh.

Bangladesh Bank’s website was taken offline as a precaution amid a global cybersecurity warning involving two critical vulnerabilities in PHP, a programming language widely used to build websites and online services.

A senior central-bank official confirmed that the website was unavailable because of an urgent security issue. The move comes as cybersecurity experts warn organisations to check their systems and apply critical software updates.

The warning centres on two vulnerabilities, identified as CVE-2026-109618 and CVE-2026-109619. According to the PHP development team, the flaws could allow attackers to execute malicious code on vulnerable servers without logging in first.

Security updates were released on October 21 for PHP versions 8.5, 8.4, 8.3 and 8.2. Organisations using affected systems have been urged to install the relevant fixes immediately.

Is Bangladesh facing a cyberattack? The website shutdown does not, by itself, mean Bangladesh Bank has been hacked. As of Friday morning, no major cyberattack in Bangladesh directly linked to these vulnerabilities had been publicly confirmed. Officials overseeing the government's National Web Portal also said their monitoring systems had not detected a related attack or security breach.

However, cybersecurity specialists warn that the risk extends beyond banks.

Websites, business applications and different types of online services use PHP. Vulnerable systems could face serious risks if organisations fail to apply the necessary security updates. Some software products may also rely on PHP in the background, even when users do not realise it.

This means government offices, private businesses, e-commerce platforms and other organisations may need to check their systems urgently.

What should organisations do now? Security guidance calls on organisations to identify internet-facing systems running affected versions of PHP, apply the relevant updates and monitor their systems for suspicious activity. Organisations that cannot apply the fixes immediately may need to isolate vulnerable services from public access until they address the risk.

For ordinary users, an unavailable website does not automatically mean personal or financial information has been stolen. People should use official channels to access banking services, avoid suspicious links claiming to offer security fixes, and never share passwords or one-time verification codes with callers or unknown contacts.

The bigger question. The incident raises a broader question about Bangladesh's digital infrastructure: how quickly can public and private organisations identify vulnerabilities and secure their online services when a critical software flaw emerges? Taking a website offline may reduce immediate exposure, but the longer-term priority is to ensure that vulnerable systems are properly updated, independently checked where necessary, and monitored for signs of compromise.

For now, the key issue is not simply why one website is offline. It is whether organisations across the country are prepared to respond to the same security threat before it becomes a larger problem.