One Bug, Two Central Banks Offline: What Happened in South Asia

0:00 Seven central banks, one red dot

On the 25th of October, we tried to open the websites of 7 central banks in South Asia. 6 opened. One didn't answer at all: Nepal's.

Bangladesh's had only just come back, after 3 days offline. Neither was reported hacked. Both were switched off on purpose, as a precaution, because of a flaw in the software behind most of the world's websites.

So why did some go dark, while others stayed online? The answer is one simple rule about old software.

0:32 The bug in one picture

The software is called PHP. It's the engine that builds a web page each time you open one. By one count, it runs about 7 in 10 websites. Think of it as the most common door lock in the world.

In this story, it was on the websites of banks and government offices. Here's how the week unfolded. On the 20th of October, details of two flaws in that lock leaked online, before a fix was ready.

Both could let a stranger run their own code on a website's server, without logging in. PHP's own team rated them 9.2 out of 10 for severity. The next day, the 21st, they released the fix.

That same day, a security firm saw attackers already trying the flaws.

1:17 The rule: new locks get fixed, old ones don't

And here's the rule that explains everything that followed. Software versions get security fixes for a few years. Then support ends, and the fixes stop. So the fix came only for the four versions of PHP that are still supported.

PHP 8.1 and anything older got no new release. Their support had already ended. And plenty of the web still runs on those old versions. At least a third of all PHP websites.

Why would anyone still run old software? In Nepal, officials pointed to older systems maintained by outside vendors, some with code that had never been audited. So every website owner had two choices.

Update, if they could. Or unplug the site until they could. Britain's cyber security agency said it plainly: update, and if you can't, consider taking the system offline.

Across Europe, many unplugged. City councils in Britain, government services in Finland, and even the Dutch cyber security agency's own website. Remember that fork.

Update, or unplug. Now, back to South Asia.

2:28 Nepal: one switch, thousands of sites

Start with Nepal, where the news arrived in the middle of Dashain, the country's biggest festival, with offices closed for a week. Most Nepali government websites run on one shared platform. So they could be switched off centrally, all at once.

Thousands of government websites went offline together. On the 22nd, the national cyber security centre told organisations to update their systems. The central bank shut its own website, and asked banks to take theirs offline where needed.

Several did. So did the provident fund and the social security fund. While its site was down, the central bank posted its daily exchange rates on social media instead.

But the money kept moving. The bankers' association said mobile banking and QR payments worked normally. And banks reported no loss of customer data or money. And the central bank was clear: a website being offline does not mean it has been hacked.

What did go dark were everyday services. The form to apply for a driving licence. The daily vegetable prices from Kathmandu's main wholesale market. Even the system that tracks freight trucks.

Drivers were told to carry their paper bills instead. Some banks were back within a day or two. Many government sites were still waiting. Because for old systems, a patch alone isn't enough.

The head of the government's software centre said some old code had never even been checked. The plan is to fix the shared platform once, and bring the sites back together. When we checked, on the 25th, the central bank's site was still down.

4:09 Bangladesh: three days dark

So far: a flaw, a fix only for new software, and in Nepal, one switch that turned off thousands of sites. Now the second red dot. On the 22nd of October, Bangladesh's government cyber team issued an urgent alert.

The same day, Bangladesh Bank, the central bank, took its website offline. Like Nepal, it happened during a long holiday. Six other banks followed, and so did the government's land services website. That one matters.

Around 300,000 people a month use it to register changes in land ownership. Visitors to the central bank's site saw a short note: the service is under maintenance. Its spokesperson said the bank wanted to ensure full security before bringing it back.

And its links with commercial banks kept running. Only the public website went dark. Other regulators, like the stock exchange and the securities commission, kept their sites up.

By the 25th, the central bank's website was back.

5:13 The rest of the map

So why did these two go dark, and not the rest? On the 25th, the central bank sites of India, Pakistan, Sri Lanka, the Maldives and Bhutan all opened. We found no reports of them going offline.

Staying online doesn't prove a site was safe. It means its owners didn't have to unplug it. Our reading: it comes back to the fork. Sites on supported versions could update the same day.

Sites on old software, or whose code nobody had checked in years, had only one safe option. Nepal's own officials said some government systems run PHP 8.1 or older, the versions that got no new release.

5:53 The next deadline

And this won't be the last time. PHP 8.2, one of the versions that just got fixed, loses support on the 31st of December. Any website still on it after that could face the same fork the next time a flaw appears: update, or unplug.

For South Asia's banks and governments, the cheapest fix isn't a faster shutdown. It's keeping the software up to date. Every source, and the date we checked each one, is in the description.

If this helped, like it, share it with someone who'd find it useful, and subscribe to The Himalayan Ledger. Tap the bell so you don't miss the next one.