Free one-page PDF
Security Checklist for Banks and Fintechs
Everything our security series says to do, on one A4 page you can print, tick off or hand to whoever owns it. What to do about PHP2Shell this week, how to plan the PHP upgrade and the habits that close the gap between a fix existing and a fix being live.
What’s on the page
Find every server
You can only patch what you know about.
Check versions the right way
What the command line says is often not what serves your pages.
Patch and verify
A patch counts once it’s live and checked.
Stopgaps if you can’t patch today
They buy you days, not months.
Signs of compromise
Look for them before you call it done.
Evidence for auditors
If you’re regulated, it’s what they’ll ask for.
Questions for vendors and hosts
Send them today and keep the replies.
Upgrade planning
PHP 8.1 or older is your warning shot.
Defend all year
Finding flaws got cheap. Fixing them is the bottleneck.
One number for the board
Days from “a fix exists” to “the fix is live and checked from the outside”, per system, every month.
The series behind it
Every line on the checklist comes from one of these four posts, where you’ll find the sources.
- PHP2Shell Explained: Who's at Risk and What to Do This WeekTwo critical PHP flaws let a stranger run code on your web server without logging in. Here's who is at risk, how to check and what to do this week.Read the post
- Still on PHP 7? A PHP 8 Upgrade Plan, Timeline and CostPHP 7 stopped getting security fixes in 2022 and PHP2Shell shows the risk. Here's how to plan a PHP 8 upgrade, how long it takes and what drives the cost.Read the post
- AI Finds Software Flaws Faster Than Banks Can Fix ThemAI now finds software flaws faster than most organisations can fix them. Why banks and fintechs have to change how they work and what to change first.Read the post
- How Attackers Use AI: What the AI Companies' Reports ShowWhat Anthropic and Google report about attackers using AI: what it means for banks and fintechs and what to change first.Read the post