The Global Internet Panic

Millions of websites faced an emergency as banks like MUFG and Bangladesh Bank took portals offline to stop a dangerous PHP flaw. Here is what happened.

When the Screens Suddenly Went Dark

If you tried opening your online banking portal over the past few days, you might have run into a brick wall.

Instead of your usual login page, your screen showed a blank white error: 503 Service Temporarily Unavailable.

Refreshing the page did not help. Switching from your computer to your phone did not help either. Within a few hours, social media was flooded with worried messages. People were asking the same questions everywhere: Is my bank hacked? Has my money disappeared? Why are some of the biggest websites in the country suddenly offline?

The blackout did not affect just one neighborhood or a single small business. It swept across major commercial banks, central government portals, and international financial institutions.

In Bangladesh, the country’s central bank, Bangladesh Bank, took its official web portal offline. Alongside it, more than ten major commercial banks, including Agrani Bank, Janata Bank, IFIC Bank, Standard Bank, SBAC Bank, and Bengal Commercial Bank, went dark. Essential citizen portals, such as the digital services of the Ministry of Land, also shut their doors.

Across the ocean in Japan, some of the wealthiest financial institutions on the planet were dealing with the exact same headache. Megabanks like MUFG Bank, which manages more than three trillion dollars in assets, Mizuho Bank, Japan Post Bank, and Shizuoka Bank restricted access to their public websites or put up emergency maintenance notices. Over in Nepal, the central bank issued an urgent warning to every lender and money transfer company across the nation.

People naturally feared the worst. But the truth behind the sudden shutdown is not what most people expected.

The banks were not robbed. In fact, they shut down their own websites on purpose.

The Scale of the Crisis: Just How Many Websites Were at Risk?

To grasp why this caused such a worldwide panic, you have to look at the sheer numbers behind how the internet works.

Almost every website you visit has two sides. There is the visual front page you see on your screen, and there is the engine running behind the scenes on a server. For more than thirty years, the most popular engine for building websites has been a programming language called PHP.

Here is why that matters:

Over 75 percent of all websites on the planet rely on PHP to run their daily pages. That represents more than thirty million active websites worldwide.
Giant platforms like WordPress, which alone powers over 43 percent of all web pages on earth, depend on PHP.
Massive internet portals, e-commerce storefronts, university systems, and corporate websites all share this exact same underlying engine.

When a major flaw is discovered in PHP, it does not just threaten one company. It threatens three out of every four websites on the entire World Wide Web.

Within just two hours of security researchers announcing the flaw, global internet security companies like Cloudflare and Amazon Web Services saw something terrifying. Automated criminal computer networks, called botnets, began scanning the entire internet.

These automated bots were knocking on digital doors at an unbelievable speed, scanning millions of websites every single minute. They were searching for any server, anywhere in the world, that had not yet installed the fix.

What Actually Happened? The Problem in Plain English

You do not need an engineering degree to understand what went wrong.

Think of a bank website as a customer service desk with a security guard at the door. Normally, when you visit a website, you hand the guard a simple request, like: “Please show me your exchange rates” or “Tell me where the nearest branch is.” The guard reads your request, gets the information from the filing cabinet, and hands it back to you.

The newly discovered security flaw, nicknamed PHP2Shell by cybersecurity experts, created a loophole in the way the server reads requests.

If a visitor sent in a message written with a specific pattern of hidden characters, the security guard would get confused. Instead of answering the question, the guard would unlock the back door, hand over the office keys, and let the visitor run any program they wanted on the server.

In computer terms, this is called Remote Code Execution. Security experts gave it a severity rating of 9.8 out of 10, which is as close to a five-alarm fire as software can get.

If hackers managed to sneak through that unlocked back door, they could change what appears on the bank’s home page, set up fake login screens to steal customer passwords, or plant hidden ransomware.

Why Banks Chose to Pull the Big Red Switch

When news of the vulnerability spread on Thursday, October 22, bank executives and cybersecurity directors faced a tough decision.

They had two choices:

Leave the website open to the public while their IT teams tried to test and install the security update in the background. But doing this meant risking that an automated bot might find the loophole and break into the website before the update was finished.
Pull the plug immediately. Turn off the public website completely, lock all the digital gates, install the security fixes in complete privacy, and only turn the website back on when they were 100 percent certain it was safe.

Major banks decided that taking their websites offline was the only responsible move.

It is like noticing a faulty lock on the front door of a jewelry store during a city-wide blackout. You do not leave the front doors open while you look for a screwdriver. You pull down the heavy metal security shutters, lock the deadbolts from the inside, and finish the repairs before reopening to customers.

Was Your Money or Account Ever in Danger?

The short answer is no.

The most important thing for regular people to understand is the difference between a bank’s public website and its core banking system:

The Public Website: This is just the digital storefront. It shows interest rates, branch locators, promotional flyers, and corporate news. This part often uses PHP because it makes creating and updating pages easy.
The Core Banking System: This is the ultra-secure vault where your actual balance, savings accounts, and transactions live. This system does not use PHP. It runs on isolated, heavy-duty private computer networks that are completely cut off from the public internet.

That is why even while the official websites were completely offline, your ATM card still worked at the cash machine. You could still swipe your card at the grocery store. Mobile payment apps like bKash and Nagad continued to transfer money without interruption.

The money was locked safely inside the vault. The bank simply closed the front lobby window while they changed the locks.

The Recovery: Bringing the Internet Back Online

Fixing millions of servers is not something that happens in ten minutes. Over the course of 72 hours, IT engineers worked through the night to inspect every line of code, install official security updates, and test their systems.

By the morning of Sunday, October 25, 2026, the storm had passed:

Bangladesh Bank brought its main portal back online at 8:00 AM on Sunday after completing full security audits.
Commercial banks across the country restored their websites one by one, assuring customers that all records were completely safe.
International banks in Japan and regional financial portals verified their defenses and returned to normal operations.

Government cyber agencies confirmed that the precautionary shutdowns worked exactly as intended. By taking their portals offline before hackers could strike, the banks prevented what could have been one of the largest data theft disasters in history.

What Should Regular People Do Right Now?

Even though the banks handled the crisis and your savings are safe, big cyber events always bring copycat scams. Here are four simple tips to protect yourself over the coming days:

Watch out for fake panic messages: Scammers love to send text messages or emails saying: “Your bank website was down, click this link immediately to reset your account password.” Never click those links. Banks will never ask you to reset your password through an unexpected text message.
Use official mobile banking apps: Official bank apps connect through secure, encrypted private channels that were unaffected by this web glitch.
Keep your own website updated: If you run your own personal blog, an online clothing shop, or a business website using WordPress, log into your hosting dashboard and make sure all updates for PHP, themes, and plugins are installed.
Do not panic if a website goes into maintenance: In today’s digital world, a company taking its website offline for a few hours is usually a sign of good security, not a sign of defeat.

Summary of What Happened

The Flaw: A critical bug called PHP2Shell was found in PHP, the coding engine powering over 75 percent of all websites worldwide.

The Attack: Hacker bots launched millions of automated scans per minute, trying to break into unpatched servers across the globe.

The Big Names Affected: Bangladesh Bank, commercial giants like Agrani, Janata, and IFIC, as well as Japanese megabanks like MUFG and Mizuho, temporarily shut down or restricted their public websites.

Your Money Is Safe: The shutdown was a protective defense. Core banking data, ATM machines, and card transactions were never touched.

Restoration: By Sunday, October 25, 2026, systems were patched, verified, and successfully brought back online.