The Bangladesh Government Computer Incident Response Team (BGD e-GOV CIRT) has warned of two critical vulnerabilities in PHP, the programming language behind a large share of the world's websites, and urged organisations to patch immediately, The Daily Star reported.
The flaws, collectively called PHP2Shell and tracked as CVE-2026-109618 and CVE-2026-109619, could allow attackers to run commands on a web server without logging in, potentially exposing stored data or disrupting services. The advisory, issued on October 22, names government portals, public-facing APIs, administrative systems and e-commerce platforms as examples of affected applications.
Government agencies, financial institutions, telecom operators and other organisations were asked to "inventory all PHP runtimes and prioritise public-facing systems for immediate patching."
Bangladesh Bank took its website offline as a precaution from noon on October 22. Internet security company Cloudflare reported millions of exploitation attempts after the flaws were disclosed, according to Reuters.
Website owners should confirm with their hosting provider that PHP has been updated, and protect admin panels with strong passwords and two-factor authentication.
Representative photo: a data centre. Photo: BalticServers.com, Wikimedia Commons, CC BY-SA 3.0.
