Several websites of some of Bangladesh’s leading educational institutions, including Bangladesh University of Engineering and Technology (BUET), the University of Dhaka (DU) and Bangladesh Medical University (BMU), remain vulnerable to potential cyberattacks due to unpatched security flaws in outdated versions of the PHP programming language.
The list of affected websites includes those of at least 15 prominent educational institutions, raising concerns over the security of institutional systems and potentially sensitive information related to students, faculty members and academic activities.
According to data from the Information and Communication Technology (ICT) Division, more than 1,000 public and private websites across the country were initially identified as potentially vulnerable due to PHP security flaws.
The latest available information, however, indicates that more than 100 websites remain at risk. Most of them belong to private organizations, although government agencies and IT companies are also among those affected.
Among the educational institutions identified are Independent University, Bangladesh (IUB), Bangladesh Agricultural University, Asian University for Women, National University and Sonargaon University.
Websites associated with Shahjalal University of Science and Technology, Rajshahi University, the Military Institute of Science and Technology (MIST), and Sapporo Dental College and Hospital have also been included in the list.
The exposure has raised concerns because university websites and associated digital platforms may contain sensitive personal and institutional information.
Departmental websites, learning management systems, admission portals and online service platforms may store students’ personal details, registration records, academic information and other institutional data.
If attackers exploit the vulnerabilities to gain unauthorized access, the confidentiality and integrity of such information could be compromised.
However, there is currently no confirmed information indicating that student data have been stolen or leaked from the identified websites.
Cybersecurity experts warn that running outdated or unsupported PHP versions can expose websites and servers to attacks, particularly when the systems are directly accessible through the internet.
Depending on the nature of the vulnerability and the server configuration, attackers may attempt to execute malicious code, gain unauthorized access to servers or take control of affected websites.
Internationally, the PHP security vulnerabilities have already triggered significant concern among cybersecurity professionals.
According to information shared by Cloudflare CEO Matthew Prince, attempts to exploit the vulnerability reached several million within the first 10 hours after the issue became public.
Against this backdrop, Bangladesh's government cybersecurity agency, Bangladesh Government's e-Government Computer Incident Response Team (BGD e-GOV CIRT), issued security advisories urging public and private organizations to identify their use of PHP and take necessary protective measures.
The advisory covered government and private institutions, banks, telecommunications operators, critical information infrastructure, educational institutions and other organizations.
BGD e-GOV CIRT recommended prioritizing security updates for servers directly connected to the internet.
Where immediate updates are not possible, organizations have been advised to temporarily disable vulnerable services or restrict access while examining server logs for suspicious activities.
Institutions have also been urged to identify the PHP versions running on their websites and servers and take appropriate measures to address the vulnerabilities.
When contacted, ICT Division Secretary Md Mamunur Rashid Bhuiyan said the government was regularly alerting public and private organizations to emerging cybersecurity threats.
“Many organizations have already taken necessary measures and secured their systems after receiving the warnings. The ICT Division will also provide the necessary technical assistance to institutions that require support,” he said.
He added that instead of issuing separate warnings to individual public and private universities, the ICT Division would communicate the advisory through the University Grants Commission (UGC).
The initiative is intended to reduce the risk of information exposure involving students and other stakeholders while ensuring the security of university websites and servers.
With more than 100 websites reportedly remaining vulnerable, timely security updates, regular monitoring and stronger institutional cybersecurity measures are essential to prevent potential attacks and protect sensitive information.
