The government has warned of critical PHP security risks to public and private websites, urging organisations to fix vulnerable systems immediately to prevent cyberattacks, data theft and unauthorised access.
The Bangladesh Government’s Computer Incident Response Team (BGD e-GOV CIRT) issued the warning on Sunday (October 25), saying its monitoring unit had detected vulnerable PHP systems in several important internet-connected networks despite earlier alerts.
Two critical vulnerabilities identified on October 22 could allow attackers to execute malicious commands remotely without authentication, steal sensitive information or take control of affected servers.
The CIRT urged organisations to check their PHP versions, install official security patches and replace outdated or unsupported releases. If immediate updates are not possible, they should restrict public access or use virtual private networks (VPNs) to reduce exposure.
It also advised monitoring suspicious requests, unauthorised file changes and unusual network traffic. The team stressed that organisations remain responsible for securing systems managed by third-party providers.
-AH