Govt’s one-stop service portal myGov goes offline

Disruption may last until midnight tomorrow

Bangladesh's one-stop government service portal, myGov, went offline today, leaving citizens and businesses unable to access a wide range of public services, as authorities announced "emergency maintenance" for security upgrades.

Visitors to mygov.bd this afternoon were met with a "Web server is down" message and Cloudflare error code 521, which indicates that the origin web server is not responding to connection requests.

The error page showed that the user's browser and Cloudflare's Dhaka node were working, while the host server for www.mygov.bd was in error.

Aspire to Innovate (a2i), which runs myGov, displayed an "emergency announcement" saying urgent maintenance was under way to improve security and service quality.

The notice said the work would continue until midnight on October 27 and that users might face temporary disruption.

"We are sincerely sorry for this," it said. The notice did not state the cause.

Speaking to The Daily Star, Muhammad Anwar Uddin, project director at a2i, which runs myGov, said the platform needed upgrades.

"We need some upgrades. That is why we want to carry out the updates," he said.

Asked whether the shutdown was linked to vulnerabilities in PHP, a programming language widely used to build websites, he said some such issues had emerged.

"Yes, there are some issues like that. Some issues have come up that are PHP-based, and some of our systems are outside PHP," he said.

He said the updates were being made for protection.

An official of the Bangladesh e-Government Computer Incident Response Team (BGD e-GOV CIRT), the government's cyber security agency, also said the agency had flagged PHP-related issues on some websites run by a2i.

"We have raised some issues regarding PHP in some websites run by a2i, and they are working on it," the CIRT official said.

CIRT issued an advisory on October 22 about PHP2Shell, a set of vulnerabilities that could allow attackers to run malicious code on servers remotely without logging in.

In a high-severity alert issued yesterday, it warned that several government and private organisations were still using outdated or unsupported PHP versions and urged them to apply verified patches or restrict public access.

The vulnerability has already disrupted digital services.

Bangladesh Bank restored its website at 8am yesterday after keeping it offline for two and a half days.

On Saturday, the websites of six banks, including Agrani, Janata and Bengal Commercial Bank, went offline, with some remaining down until Sunday. The land ministry also suspended services on land.gov.bd for about 36 hours from midnight on October 22.

CIRT has cautioned that running an outdated PHP version does not necessarily mean a system has been attacked, as the actual risk depends on the version in use, whether patches have been applied and how exposed the system is to the internet.

myGov brings government-to-citizen, government-to-business and government-to-government services together online. Users apply for services from different ministries, track applications in real time and pay fees. Services include certificate attestation, land-related applications, allowances, and business licences and permits.

A prolonged shutdown is therefore likely to affect people with pending applications, including those seeking attestation for study or travel abroad, and businesses waiting for licences or permits.