Staff Reporter

More than 500 websites and applications in Bangladesh are vulnerable to cyberattacks, including platforms operated by government and private organisations, financial institutions and providers of essential public services. The risk has arisen from the use of outdated versions of the PHP programming language, according to the government's cybersecurity agency, BGD e-GOV CIRT.

Sources at the agency said many organisations had yet to update the PHP versions used on their websites and applications despite receiving warnings, raising concerns over the security of the country's digital services.

New Security Vulnerability in PHP

PHP, or Hypertext Preprocessor, is a programming language widely used to manage the back-end operations of websites. According to a BBC report citing cybersecurity firm Wiz, a large number of websites worldwide rely on PHP.

Recently, researchers from US cybersecurity firms KALIF and Wiz identified two security vulnerabilities in PHP with the assistance of artificial intelligence. In response, the PHP development team released an emergency security update on October 21 to address the two serious flaws. On October 23, the PHP authorities disclosed the discovery of another vulnerability.

The newly identified flaw is associated with PHP's session management system and a feature used to track file-upload progress. Experts fear that attackers could exploit the weakness to execute unauthorised commands on servers.

More Than 500 Websites Identified as Vulnerable

The Cyber Threat Intelligence Unit of BGD e-GOV CIRT has identified more than 500 potentially vulnerable websites and applications in Bangladesh through its monitoring activities. Although most belong to private organisations, the list also includes important government and financial-sector websites.

Nazmul Haque Khandaker, project director at BGD e-GOV CIRT, told Prothom Alo that the risk could be reduced by updating the affected websites. However, he said the number of vulnerable websites identified so far was concerning.

Agency officials said some organisations continued to use outdated and vulnerable PHP versions despite receiving security warnings. The failure to apply necessary security updates could expose sensitive information to theft and increase the risk of cyberattacks.

Recommendations to Reduce the Risk

In its latest advisory, BGD e-GOV CIRT said a security patch for the newly identified vulnerability had not yet been released. The affected versions and the severity of the risk had also not been conclusively determined.

In the meantime, the agency has advised the organisations concerned to temporarily disable PHP's session upload progress feature, keep essential server services running, review software configurations and monitor suspicious activities.

Junaid Miazi, chief technology officer (CTO) of a private hosting company, told Prothom Alo that many people assume a website is secure simply because it is functioning normally. As a result, they often neglect regular software updates and security fixes.

He stressed that keeping software up to date is essential to maintaining website security.

Who Is Responsible for Website Security?

The National Cyber Security Agency and BGD e-GOV CIRT, which operates under the Bangladesh Computer Council, play roles in protecting the country's digital infrastructure. Identifying cyber threats and warning relevant organisations about security vulnerabilities are among CIRT's key responsibilities.

However, questions remain about the effectiveness of mechanisms for ensuring that organisations address vulnerabilities promptly after receiving warnings and properly implement the recommended security measures.

Information technology expert Sumon Ahmed Sabir told Prothom Alo that individual organisations were responsible for securing their own websites. However, he said assigning responsibility alone was not enough; there also needed to be mechanisms to verify whether organisations were following appropriate security practices.

He emphasised the need for a national framework to establish cybersecurity standards and ensure that organisations comply with them.