Bangladesh Bank and at least 10 commercial banks have temporarily shut down their websites amid fears of potential cyberattacks following the detection of a serious security vulnerability in PHP, a widely used web programming language.

The precautionary measures were taken to prevent possible data theft and unauthorised access while the institutions assess their information technology infrastructure and strengthen security systems.

Bangladesh Bank shut down its website on Thursday (October 22). Following the central bank’s move, several state-owned and private commercial banks also suspended access to their websites.

The banks include Agrani Bank, Janata Bank, Mercantile Bank, First Security Islami Bank, IFIC Bank, Shahjalal Islami Bank, Standard Islami Bank, SBAC Bank and Bengal Commercial Bank.

Officials at the affected banks said the websites would be restored after necessary security checks, system updates and other precautionary measures were completed.

Bangladesh Bank spokesperson Arif Hossain Khan said no cyber incident had been reported so far. However, all banks had been instructed to remain vigilant, and central bank officials were maintaining regular communication with their information technology teams to monitor the situation.

Agrani Bank Chairman Syed Abu Naser Bakhtiar Ahmed said the bank began taking precautions after receiving international security alerts. It temporarily shut down its website after learning that Bangladesh Bank had taken a similar step.

He said Agrani Bank would keep its website offline until the central bank’s website was restored. The bank’s chief technology officer and IT team were working to address potential risks.

Mercantile Bank also adopted precautionary measures. Its Managing Director Matiul Hasan said the website would be restored once the security risks had been addressed.

Shahjalal Islami Bank suspended its website after receiving a warning about the use of certain PHP-based technologies. Its Managing Director Mosleh Uddin Ahmed said the bank immediately took the website offline and began strengthening its security systems, with the IT department working round the clock.

Cybersecurity experts cautioned that using PHP does not automatically make a website vulnerable to cyberattacks. The level of risk depends on the software version, server security, timely updates and connections with other technologies.

Mahbubur Rahman Alam, a professor at the Bangladesh Institute of Bank Management (BIBM), said the international situation indicated an elevated level of cyber risk. However, the existence of a security vulnerability, an attempted attack and an actual data breach were distinct events, he said.

He added that institutions using outdated PHP versions and failing to install security updates on time faced greater risks.

According to the expert, banks’ core banking systems, SWIFT networks and major transaction infrastructure generally do not depend directly on PHP. As these systems operate through separate and controlled networks, regular banking transactions, app-based services and mobile financial services remain operational.

Financial institutions in several countries have also introduced precautionary measures in response to the reported PHP vulnerability.

In Japan, Mitsubishi UFJ Bank temporarily suspended some online banking transactions, while Mizuho Bank and Daiwa Securities began emergency maintenance. Aomori Michinoku Bank, Shizuoka Bank, Yamanashi Chuo Bank and San-in Godo Bank also temporarily suspended some online and app-based services. Japan’s interbank settlement system, however, remained unaffected.

Nepal’s central bank instructed banks, financial institutions, payment service providers and remittance companies to strengthen cybersecurity measures. It also advised institutions to temporarily shut down vulnerable websites if necessary while implementing security updates.

Some banks and government agencies in Nepal suspended their websites, while mobile banking and QR-code payment services remained operational.

The European Banking Authority also temporarily took its website offline for security updates before restoring it after the necessary safeguards were implemented.

Authorities in China and South Korea instructed critical institutions, including banks, to identify vulnerable PHP versions, install security updates and monitor suspicious activities. Banks and financial institutions in India have also intensified security checks on their websites, applications and online services.

The report also cited the detection of a leak involving personal information belonging to 3,897 State Bank of India customers. An investigation is under way to determine the source and extent of the incident. However, no direct link between the data leak and the reported PHP vulnerability has been established.

Experts said the growing use of artificial intelligence was making it easier to identify software vulnerabilities and prepare attacks exploiting them. Tasks that previously took skilled attackers weeks or months could, in some cases, be completed within hours with AI assistance.

Cybersecurity company Cloudflare has also reported vulnerabilities in several important software systems, prompting efforts to develop security updates.

Dr Mustafizur Rahman, a professor in the Department of Computer Science and Engineering at the University of Dhaka, said security vulnerabilities in PHP were not new and had been identified and addressed in the past. He described the current risk as a new manifestation of an existing problem.

Experts said the immediate priority for Bangladesh’s banks and financial institutions was to identify vulnerable software and servers, particularly those connected to websites, customer service portals, online application systems and third-party technologies.

Abdullah Al Jaber, director of cybersecurity organisation Cyber 71, said institutions should not wait for a threat to emerge before strengthening their defences. Banks and financial institutions should conduct penetration tests every six months or at least once a year to identify weaknesses in their systems, he said.

He added that many institutions in Bangladesh did not conduct such tests regularly and generally intensified security measures only after major threats or incidents emerged.

Tanzim Al Fahim, founding director of private cybersecurity firm Arena Web Security, also stressed the need for urgent security audits of banks, financial institutions and fintech companies.

He said internet-facing servers, PHP-based systems and application programming interface (API) connections needed to be examined promptly.

Despite precautionary measures taken in several countries over the PHP vulnerability, no confirmed information has emerged so far about a major cyberattack, data theft or financial loss directly linked to the reported risk.

Officials and experts said temporarily shutting down websites, isolating vulnerable servers, installing security updates and maintaining continuous monitoring could help reduce the possibility of attacks.

However, weaknesses in third-party service providers, hosting companies, payment gateways and API connections could create additional risks even when a bank’s core technology infrastructure remained secure. Experts therefore emphasised the importance of regularly assessing the security of both banks’ internal systems and their external technology partners.