Two critical PHP flaws: BGD e-GOV CIRT tells organisations to list servers and check versions

Photo: Collected

Organisations in the country must first draw up a list of where PHP is running on their servers, and then check whether the versions in use are vulnerable — this is the instruction issued by BGD e-GOV CIRT, which is responsible for overseeing the government’s cyber security. With two critical security flaws found in PHP, a programming language widely used to build and run websites, an alert has now been issued in Bangladesh too over this risk, known as ‘PHP2Shell’. Exploiting the flaws, cyber attackers can run malicious code on servers remotely without verifying the user’s identity. To avoid the risk of cyber attacks, various government agencies and commercial organisations in many countries around the world have temporarily taken their websites offline.

In a security advisory published today (Thursday, 22 October), CIRT referred to two flaws, numbered CVE-2026-109618 and CVE-2026-109619. By exploiting them, attackers can run code remotely on vulnerable servers; this raises the risk of servers being taken over, data being stolen or websites being disrupted.

According to the advisory, servers based on PHP-FPM, Apache using mod_php, PHP-CGI, FrankenPHP and LiteSpeed may be exposed to this risk. Containers, shared hosting and various web applications built in PHP have also been asked to be checked.

PHP is a programming technology used to run various functions of websites. It is used in many systems, including government web portals, online services, administrative systems and e-commerce platforms. So a flaw on any server could compromise the security of the data and operations of the website concerned.

Various international alerts from cyber security experts have also treated the two flaws as a serious risk. The digital security division of the UK’s National Health Service said they could open the way to running code remotely without identity verification or to obtaining sensitive information. It assessed the likelihood of the flaws being exploited in future as high.

Officials of the Aspire to Innovate (a2i) project, which is involved in building and maintaining government websites in the country, said the websites of the national portal system they run are not built in PHP, so they should not be directly at risk from this flaw. However, beyond the national portal, various government organisations and offices have their own websites, which may be built in PHP; according to those concerned, these are at risk. PHP is also used in the private sector in the country to build websites and various web-based applications. Experts therefore fear the flaw could affect various organisations and online services outside the government’s national portal.

No specific count was available of how many government websites or servers in the country run PHP. However, given PHP’s global use and its wide application in government online services, cyber security expert Tanvir Hasan Zoha has urged that vulnerable servers be identified quickly.

Tanvir Hasan Zoha, associate professor in the Department of Cyber Security and Digital Forensics at Daffodil International University, told Ajker Patrika today that by his estimate 60 to 85 per cent of the country’s government websites may use PHP, though this is not a verified figure. He stressed drawing up a list of the PHP versions on government servers. In particular, he advised first finding and securing the servers directly exposed to the internet.

Tanvir Hasan Zoha advised that the servers concerned be updated quickly to PHP versions containing the security fix. Where immediate updating is not possible, temporary access control through firewalls and, if necessary, disconnecting them from the internet should be considered. It is also essential to go through the server logs of the past few days to look for unusual requests or suspicious activity.

Tanvir Hasan also proposed that BGD e-GOV CIRT issue coordinated instructions with deadlines. In his view, ensuring cyber security requires not only laws and policies but also keeping technical infrastructure up to date and building the capacity to respond quickly.

BGD e-GOV CIRT has advised organisations to update the PHP runtime quickly to fix the flaws. The advisory reminds them that updating an application or framework does not update the PHP runtime behind it. So it must be ensured that the security fix has been applied to the actual PHP version handling web requests on the server.

Until the update is done, the risk can be reduced by changing configurations and restricting network access, but this is not a permanent solution. It is also important to check whether any server was breached before news of the flaws came out, because updating the software does not automatically remove any earlier intrusion or malicious changes.

Source — original report: Ajker Patrika