Any financial institution still operating mission-critical websites built on PHP or with any PHP components deserves the immediate loss of your business.

PHP has been a known security risk for several, if not many, years. Remediating its vulnerabilities has been a top security priority for at least 15 years for organizations that have the resources to do so.

The little non-profit I used to work for "ring-fenced" their Wordpress site in 2020 or 2021, only because a former enterprise CIO joined and forced addressing the vulnerabilities running some cheap e-commerce product attached to it. It still took another 4 years for them to get completely off Wordpress.

This situation with the arcane PHP vulnerability seems similar to the Hawthorne Effect.

FC