[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fjUPoPrHkSsGCbeGDPZBnlygTCbTwOnh9g-zyTc2AFzI":3},{"article":4,"iocs":55,"watch_terms":56,"solutions":57,"lesson":143},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"511e59d8-4062-49f1-ac07-1884cfa0e922","ATM Flaws Reveal Key Weaknesses in the Software Supply Chain","atm-flaws-reveal-key-weaknesses-in-the-software-supply-chain-4194b5","A security researcher discovered nine vulnerabilities impacting ATM encryption and authentication software. But the problems extend far beyond your local cash machine.","Security researcher Matt Burch discovered nine vulnerabilities in CryptoPro Secure Disk, software used in ATMs and other critical systems for disk encryption and pre-boot authentication. These flaws could have allowed attackers to bypass integrity checks and gain full access to encrypted devices. While the German firm CryptWare has since patched the vulnerabilities, the incident highlights the broader challenges of software supply chain security, as patches must be implemented by numerous downstream customers across various industries.","Nine vulnerabilities in CryptoPro Secure Disk software impacted ATM encryption and authentication.","https:\u002F\u002Fwww.wired.com\u002Fstory\u002Fatm-flaws-reveal-key-weaknesses-in-the-software-supply-chain\u002F","https:\u002F\u002Fmedia.wired.com\u002Fphotos\u002F6a7211d55fe571c2f9c67e78\u002Fmaster\u002Fpass\u002FSeucirty_ATMsCanBeHackedThroughTheSoftwareSupplyChain_v1.gif","2026-08-31T10:00:00+00:00","2026-08-31T12:00:09.511124+00:00",8,[17,20,23,25,27,30],{"name":18,"type":19},"CryptoPro Secure Disk","product",{"name":21,"type":22},"CryptWare","vendor",{"name":24,"type":19},"Vynamic Security Suite",{"name":26,"type":22},"Diebold Nixdorf",{"name":28,"type":29},"ATM","technology",{"name":31,"type":29},"Microsoft Windows","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,45,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,26,18],{"controls":58,"vendors":142},[59,88,116],{"slug":60,"name":61,"problem":62,"products":63},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":89,"name":90,"problem":91,"products":92},"patch-management","Automated patch management","Known holes get closed in days, not months.",[93,101,108],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":89,"product_name":105,"url":106,"description":107},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":117,"name":118,"problem":119,"products":120},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png","sonatype-firewall","Sonatype Firewall","https:\u002F\u002Fwww.sonatype.com\u002Fproducts\u002Fsonatype-firewall","Blocks malicious and policy-violating open-source components at download.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":138,"product_name":139,"url":140,"description":141},"jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[],{"slug":144,"title":145,"body":146,"framework_refs":147,"framework_notes":157},"atm-encryption-software-flaws-expose-supply-chain-risk","ATM Encryption Software Flaws Expose Supply Chain Risk","Nine vulnerabilities in CryptoPro Secure Disk — software embedded in ATMs and other critical systems — allowed attackers to bypass integrity checks and gain full control of encrypted devices, exposing a fundamental weakness in third-party software dependencies. The root issue is a classic supply chain problem: a single vendor's flawed component can silently introduce critical risk across countless downstream customers who may not even be aware the software is in use. While the vendor patched the flaws, the real danger lies in the propagation gap — the time between a vendor releasing a patch and every downstream operator actually applying it. This incident underscores that organizations cannot rely solely on vendors to protect them; they must actively track third-party software components and enforce timely patch adoption.",[148,149,150,151,152,153,154,155,156],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","NIST SP 800-161: Supply Chain Risk Management Practices","NIST CSF ID.SC-2: Suppliers and third-party partners of information systems are identified","NIST SI-2: Flaw Remediation","NIST SR-3: Supply Chain Controls and Processes","ISO\u002FIEC 27036: Information Security for Supplier Relationships","ITIL Change Management: Emergency Change Procedures","GDPR Article 32: Security of Processing (for any ATMs handling personal data)",{}]