Cyber Flaws Expose Bangladesh’s Banking Sector to Hackers

Bangladesh’s banking sector is facing fresh cyber-security concerns after critical software vulnerabilities forced the Bangladesh Bank and several commercial banks to shut down or suspend access to their websites, exposing the risks posed by weaknesses in the country’s digital defences.

The incident has renewed questions about banks’ preparedness to withstand cyberattacks, a vulnerability The Daily Observer had highlighted in several earlier reports, as financial institutions increasingly rely on digital platforms to deliver services.

The Bangladesh Bank website resumed operation at 8:00am on Sunday after remaining offline since Thursday as a precaution against potential attacks linked to two critical security flaws in PHP, a widely used programming language for websites and online applications. The websites of state-owned Janata Bank PLC and private Bengal Commercial Bank PLC remained inaccessible during the day, displaying maintenance notices.

Although no successful cyberattack on the affected institutions had been confirmed, the vulnerabilities could allow attackers to execute malicious code remotely on affected servers without authentication, potentially exposing sensitive information and enabling unauthorised access.

Bangladesh Bank spokesperson and Executive Director Arif Hossain Khan confirmed the restoration of the central bank’s website, saying it had been temporarily shut down over cybersecurity concerns. Its technical team assessed the risks and took protective measures before restoring public access.

The shutdown did not affect communications between Bangladesh Bank and commercial banks, he said. Internet banking and mobile financial transactions also continued normally, according to officials, with no reported disruption to core banking operations.

The vulnerabilities prompted a wider security review across Bangladesh after the PHP development team released emergency updates on October 21. The government’s BGD e-GOV Computer Incident Response Team (CIRT) issued an advisory on October 22, urging organisations to identify affected installations, apply security patches and restrict access to vulnerable systems where immediate updates were not possible.

At around 2:15pm on Sunday, visitors to Janata Bank’s website encountered a notice saying its application was undergoing maintenance and would be restored soon. Bengal Commercial Bank also said its website service was temporarily unavailable, providing telephone numbers and an email address for customer assistance.

The continued outages raised concerns over customers’ access to website-based information and services, although there were no immediate reports of disruption to the banks’ core financial transactions.
The European Union Agency for Cybersecurity (ENISA) has highlighted the potential risks associated with the PHP flaws. However, the extent of exposure depends on the software versions, server configurations and security updates used by individual organisations.

Bangladesh Bank has directed scheduled banks to strengthen their digital safeguards, including scanning public-facing servers for vulnerabilities, applying security patches, reinforcing authentication and improving continuous monitoring of suspicious activity.

Banks are also being urged to establish or upgrade Security Operations Centres (SOCs) to detect potential threats around the clock and enforce multi-factor authentication for sensitive administrative access. Keeping public-facing websites isolated from core banking systems and payment networks is another key safeguard against the risk of a compromised website becoming an entry point to critical financial infrastructure.

Officials of the government’s Aspire to Innovate (a2i) programme said around 36,500 websites under the National Portal Framework were not built using PHP and were therefore not directly exposed to these particular vulnerabilities. The assurance, however, does not rule out other software-related risks.

The latest episode highlights the challenge facing Bangladesh as it expands digital financial services while confronting increasingly sophisticated cyber threats. Even precautionary website shutdowns can disrupt access to information and undermine confidence if institutions lack effective security controls and contingency arrangements.

For banks entrusted with customers’ deposits and sensitive financial information, the immediate priority is to close identified vulnerabilities, strengthen monitoring and ensure that public-facing digital services remain secure without compromising the integrity of core banking operations.