Countries and organisations around the world have begun taking emergency measures after two serious security flaws were discovered in PHP, a web technology widely used across the internet.

Government websites and online services operated by financial institutions, transport providers and other organisations have been temporarily taken offline in several countries in Europe and Asia. Within hours of the vulnerabilities being made public, hacking attempts reached several million.

BGD e-Gov CIRT, which oversees cyber security in Bangladesh, has warned government agencies, banks, telecommunications operators and operators of critical infrastructure to identify PHP-based systems quickly and apply security updates. It advised prioritising systems accessible directly from the internet and, where an immediate update is not possible, temporarily shutting down at-risk services, limiting access and cutting direct connections to the main server. Server logs and related activity should also be examined.

The Bangladesh Bank website was taken offline on Thursday evening because of the risk and remained down on Friday afternoon when this report was filed.

About 70 percent of websites worldwide whose programming language can be identified, and even the popular content management system WordPress, rely on PHP. A serious flaw in PHP therefore has consequences beyond a single organisation or country: a large number of websites can be targeted simultaneously using the same vulnerability.

The greatest risk is to websites and online services running vulnerable or outdated versions of PHP. These include government portals in various countries, bank and financial institution websites, e-commerce sites, administrative systems, organisations’ own web applications and shared-hosting sites.

Technology experts believe many public and private online services in Bangladesh are also exposed.

Tanvir Hasan Zoha, an associate professor in the Department of Cyber Security and Digital Forensics at Daffodil International University, told Bonik Barta that the problem lay within PHP itself.

“If a vulnerable version of PHP is used, the server can be compromised. The flaw could allow code to be run remotely on the server without any password,” he said.

Zoha noted that no published figures exist on how many government websites in Bangladesh run on PHP, but estimated that between 60 and 85 percent of public and private websites in the country may use it.

“The first task should be to draw up a list of PHP versions and prioritise servers that are directly accessible from the internet. They must then be updated to the patched version as quickly as possible. Until the update is complete, firewalls and other security measures can reduce the risk somewhat, but they are not a permanent solution. If an update isn’t possible, the website concerned should be temporarily disconnected. It’s also essential to examine server logs from recent days for signs of abnormal requests or intrusions,” he said.

The two security flaws in PHP mainly concern how requests to websites are processed and how server memory is managed. Hackers can exploit them by sending specially crafted requests, potentially allowing them to run their own code on an affected server without a password or user permission.

If attackers successfully exploited the flaws, they could view or alter data held on the server, steal passwords and other important information, or try to take websites and online services offline.

Cyber security agencies in Europe, Australia, Japan and the UK have advised organisations to update PHP immediately or keep websites offline until patches are applied. Most European countries have temporarily closed government websites to avoid the risk.

BGD e-Gov CIRT project director Md Nazmul Haque Khandoker told Bonik Barta that a2i and the Data Centre Company were informed after the warning was issued about the PHP security flaw and that the institutions concerned were taking their own measures to address the flaw.

He added: “Institutions that are at risk because of it can, if necessary, keep their websites offline temporarily and carry out security patch updates.”

As of last night, CIRT had no information about any such attacks, Khandoker said, although some institutions had begun applying patches as a precaution.

Cloudflare has illustrated how quickly the risk is turning into actual attack attempts. Chief executive Matthew Prince said attack attempts had exceeded several million within 10 hours of the official disclosure.

European countries began taking precautionary measures on Wednesday. Germany’s central IT service provider temporarily closed several government websites. France’s interior ministry shut various local administration websites. In the Netherlands, websites belonging to the port of Rotterdam, government bodies, political parties and several hospitals were temporarily taken offline. The Finnish government also shut down government web services while it carried out security updates.

Similar steps were taken in Asia. Japan’s finance ministry and meteorological agency limited some online services, and the country’s tax department temporarily closed its online services. Large financial institutions, airlines and railway companies also temporarily suspended some services.

Bangladesh Bank’s spokesperson and executive director Arief Hossain Khan told Bonik Barta that hackers had repeatedly carried out cyberattacks on central banks around the world. “The Bangladesh Bank site has therefore been taken offline temporarily to protect against a possible cyberattack and as part of our precautionary measures,” he said. “The website will be restored as soon as the necessary security measures and checks have been completed.”

Bangladesh now faces two main challenges. The first is to identify quickly which online services and websites belonging to government bodies and important private institutions are at risk from the flaw. The second is to establish whether intrusion attempts or attacks have already occurred anywhere, a task that goes beyond simply applying security updates.

Dr Mashiur Rahman, an IT expert and engineering manager at Omron Healthcare Singapore, said many institutions in Bangladesh still relied on old technology and old versions of PHP. “The risk may therefore be comparatively higher for Bangladesh. The most urgent task now is to patch vulnerable PHP versions quickly.”

Advising that cyber security be given greater priority in the long term, the expert said: “Institutions need a dedicated team to monitor which systems, software and frameworks are in use, whether they are regularly updated and where potential security risks are emerging. The systems and frameworks in use must also be brought under regular security audits.”

Sukarna Barua, an associate professor in the Department of Computer Science and Engineering at Bangladesh University of Engineering and Technology (BUET), likewise said using an old version of any software, particularly one no longer supported by its developer, left a security risk.

“If a developer stops supporting an old version, a patch or update won’t be available even when a security flaw is found. Absolute security can’t be guaranteed, but using supported and updated versions greatly reduces the risk,” Barua told Bonik Barta.

He added: “We must move as quickly as possible to an updated version that does not contain the vulnerability. If an immediate update is not possible, a vulnerable website should not be kept running until a patch is available. Particularly when the vulnerability is serious, the safest course is to suspend the service as a precaution.”

Those involved say the flaw poses no direct risk to core banking systems, but it is a source of concern for bank and financial institution websites and other internet-facing services. Where a bank’s website, customer service portal or other web-based system runs on a vulnerable version of PHP, attackers could try to obtain stored data or gain access, or to disrupt services. That is why financial institutions in several countries are keeping some online services offline while they apply security updates.

According to Reuters, Japan’s brokerage Nomura and lender Mitsubishi UFJ Financial Group have temporarily suspended some internet services as a security measure. The insurer Tokio Marine Holdings has also taken its group website offline.

The flaw is not, however, being treated as a crisis for core banking systems; the emphasis instead is on quickly identifying, testing and patching PHP-dependent websites, customer service portals and other internet-facing services.

One Bank managing director Muhit Rahman sees no cause for alarm in the banking sector. “PHP is hardly used in core banking. Some banks’ websites may run on it. But lumping the two together risks creating unnecessary panic,” he told Bonik Barta.

Experts describe the situation as a global cyber security risk rather than a problem for Bangladesh alone. Countries and companies around the world are assessing their exposure and taking remedial measures, they say, urging Bangladesh to adopt a precautionary stance.

The National Cyber Security Agency (NCSA) is working with CIRT and other government agencies to assess the potential impact, monitor the progress of security updates and put necessary safeguards in place, its director general Dr Md Taibur Rahman told Bonik Barta.

He said the agency’s priority was to secure vulnerable systems as quickly as possible, while maintaining the continuity and reliability of government digital services.

ICT Division Secretary Md Mamunur Rashid Bhuiyan said the government was alert to the threat. “We are warning the country’s critical information infrastructure,” he told Bonik Barta. “At the same time, a range of initiatives are underway to build up our cybersecurity capacity.”