Biman suspends Dhaka–Dammam flights until 25 October and Riyadh until 31 October

Bangladesh's e-Government Computer Incident Response Team has issued a high-severity alert over two critical flaws in PHP, the server software that runs a large share of the world's websites, warning that unpatched government portals, bank sites and online shops could be taken over remotely.

The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619 and nicknamed PHP2Shell, became public on 21 October. Both carry a CVSS severity score of 9.2 out of 10, inside the critical band. The PHP project, the volunteer group that maintains the language, released emergency updates the same day.

The problem is not in any single website's code but in the PHP runtime itself. When PHP handles a request it reserves memory, and normally releases it when the work is finished. In the first flaw, a request that hits the memory limit is interrupted before some internal data has been fully set up, and the cleanup routine later treats that unfinished data as if it were valid. In the second, a fatal error leaves references to memory that has already been freed, and a later request handled by the same worker can follow those stale pointers.

In both cases an attacker can send a specially crafted HTTP request and, under the right conditions, run their own commands on the server without a username or password. Because the weakness sits in the interpreter, updating a content management system, plugin or theme does not fix it. The PHP runtime on the server has to be replaced.

BGD e-GOV CIRT said users of PHP-FPM and Apache's mod_php are at particular risk, with other exposure in PHP-CGI, FrankenPHP, LiteSpeed, Docker containers and shared hosting. It listed government portals, banks, e-commerce platforms and sites built on WordPress and Laravel as potentially vulnerable. A successful attack, the alert said, could mean full control of a server, theft of files and data, exposed database passwords and API keys, and outages.

The agency told administrators to move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35, and to check the runtime underneath the application rather than only the framework. Where patching cannot happen at once, it advised putting servers behind a VPN, restricting access with IP allowlists and increasing log monitoring. It stressed that updating is the only permanent fix.

The PHP project went further in its own advisory, publishing temporary settings that block known attack paths. They include removing the memory limit, lowering the maximum accepted request size, switching off session upload progress and, on PHP 8.5, turning off fatal error backtraces, followed by a restart of every worker. The project was explicit that these measures reduce exposure but do not make a server safe.

Outside Bangladesh, the disclosure set off a wave of precautionary shutdowns. The Dutch national cyber security centre, the Port of Rotterdam, hospital websites and the sites of the Netherlands' five largest political parties went offline, according to Reuters reporting cited by The Daily Star. Finland closed government public web services, France's interior ministry put its sites into maintenance, and Denmark's Kombit shut several services including a national school communication platform. Wikimedia took some systems offline and the Internet Archive briefly went dark.

The scale is what made the response so broad. W3Techs, which surveys web technology, estimates PHP powers 69.3 percent of websites whose server-side language can be identified. Wiz, one of the security firms involved in the discovery, said the bugs ranked among the most severe ever found in PHP. Censys data cited by Reuters found about 1.5 million of 2.6 million hosts reporting PHP versions for which no fix was available at the time.

There were also signs that attackers moved before defenders did. Amazon's security chief, CJ Moses, said the company detected an attempted exploit against a decoy system on 17 October, four days before public disclosure, and that the flaws were later being broadly exploited in the wild. Amazon could not say whether the earlier attempts would have worked against real sites.

For Bangladesh, the practical risk is concentrated in small and medium organisations that rent space on shared hosting and rely on the provider to keep software current. Such operators often have no security staff of their own, and may not know which PHP version their site is running. The same applies to many school, clinic and union council websites built years ago and never touched since.

What is not yet known is whether any Bangladeshi site has actually been breached. The CIRT alert describes the danger and the fixes but does not report a compromise, and no government list of affected sites has been published. It is also unclear how quickly local hosting companies have applied the updates, or whether older installations on end-of-life PHP branches will be migrated at all.

The PHP project has said it will not issue further releases for PHP 8.1 and older, though it published source-level backports for 7.4, 8.0 and 8.1 and asked users to check their distribution or support vendor. Sites still on PHP 5 or 7 without a vendor fix remain exposed for as long as they stay online.

The immediate test is administrative rather than technical. Website owners need to confirm their PHP version, ask their host what has been patched, and recheck after any change, because container images and old workers can keep running vulnerable code after an update is installed elsewhere on the machine. Security agencies in several countries have also warned that phishing messages citing the incident are likely, since panic over a patch is itself an opening for attackers.

For readers, there is little to do beyond normal caution: treat unexpected emails or messages about the PHP flaw as suspect, and avoid entering passwords after following a link from one. For the agencies and companies running the affected sites, the window between disclosure and exploitation is already open.

Japan is expected to arrange one trillion yen, about $6.35 billion, in private-sector investment in Bangladesh over the next five years, with the commitment due to appear in a joint statement when Prime Minister Tarique Rahman visits Tokyo next week.

The figure comes from a Nikkei Asia report published on Thursday and cited by Reuters. Neither government has confirmed it, and no Bangladeshi outlet has independently verified the number.

According to the report, the package is to be announced after Rahman meets Japanese Prime Minister Sanae Takaichi at her office on 27 October. The two are also due to hold a working dinner that evening. Rahman's four-day visit runs from 26 to 29 October, and both sides are expected to upgrade the relationship to a higher strategic partnership.

Nikkei said the money would go mainly to automobile manufacturing, other industries and energy infrastructure. Japanese companies are also expected to put funds into the Bangladesh Special Economic Zone, a project built with the trading house Sumitomo Corporation and other partners. At Tk 122 to the dollar, the sum is about Tk 774.7 billion.

The report described the arrangement as part of Japan's effort to expand economic cooperation with Bangladesh while reducing China's influence in the region. China is Bangladesh's largest source of imports.

Japan has for decades been one of Bangladesh's largest development partners. It has financed the Dhaka metro, the third terminal at Hazrat Shahjalal International Airport and the Matarbari deep-sea port. The proposed arrangement would move part of the relationship from government loans and grants towards private capital. Bangladesh and Japan signed an economic partnership agreement in February, and Nikkei cited the country's labour costs, manufacturing base and a market of about 170 million people as attractions.

In Dhaka, Foreign Secretary Asad Alam Siam told a briefing on Tuesday that the visit would cover access for Bangladeshi products to the Japanese market, more Japanese investment and closer business links. He said about eight memorandums of understanding were under discussion, covering agriculture, fisheries, skills and human-resource development, civil aviation and other sectors, and that officials hoped to sign three or four. Renewable energy, the environment, science, technology, digital innovation and research were also on the agenda.

Much remains unsettled. Neither government has published the figure or said whether the joint statement will name it. There is no breakdown by sector, no list of companies expected to invest, and no indication of how much of the total is new money rather than projects already in the pipeline. The Daily Star said it could not independently verify the report; Reuters said it could not immediately verify it either.

Delivery will be the test. Japanese manufacturers have invested far less in Bangladesh than its labour costs might suggest, and investment has grown slowly, with reliable power, land and port capacity among the constraints companies raise. A five-year private-sector target gives both governments a number to report against, but it does not by itself build a plant.

A Japanese business delegation is expected in Bangladesh soon, and a public-private dialogue on economic cooperation is planned during the visit. For Dhaka, the goals are jobs, a manufacturing base beyond garments and new power capacity. For Tokyo, it is a firmer foothold in a market where China is dominant. Rahman returns on 29 October, and the joint statement will show how much of the package is firm.