Photo: Collected
The website of state-owned Janata Bank could not be brought back online as of 11:30am on Sunday. Although it had been shut down earlier because of the risk of cyberattacks, the site fell into the hands of hackers. Staff of the bank’s information technology (IT) department are working to fix at least two places where spam was detected, bdnews24 reports.
A senior official of Janata Bank’s IT department said, ‘Signs of two attacks were found on the website. It is taking time to fix them. Hopefully, it will be possible to bring it back online today.’
The websites of Bangladesh Bank and Janata Bank had been kept shut since last Thursday as an extra precaution in view of the risk of global cyberattacks.
Although the Bangladesh Bank website was brought back online on Sunday in line with the resumption of banking operations after a five-day holiday, Janata Bank’s could not be restored.
The European Union’s cybersecurity agency ENISA and related agencies issued a warning about the risk of cyberattacks after two critical security flaws were discovered in PHP, a programming language widely used around the world.
The joint warning, issued on 21 October, said attackers could exploit the flaws to run malicious code on affected servers. It also advised that vulnerable web applications be temporarily disconnected from the internet if security updates could not be applied quickly.
After the warning, various organisations took steps to secure their websites.
According to information available as of 11:30am on Sunday, the websites of state-owned Sonali, Agrani, Rupali and BASIC banks were up and running.
At a glance
According to a joint statement by ENISA, the European Union’s cybersecurity agency, the two flaws have been identified as CVE-2026-109618 and CVE-2026-109619; exploiting them, it is possible to run malicious code on a server remotely without any authentication. PHP’s security team released updates on 21 October itself.
According to an alert from the Canadian Centre for Cyber Security, the two flaws have been fixed in PHP versions 8.5.12, 8.4.27, 8.3.36 and 8.2.35, and the agency has advised organisations using affected versions to update immediately.
Sources
Background sources: ENISA (European Union Agency for Cybersecurity), 21 October 2026; Canadian Centre for Cyber Security, 21 October 2026
