[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:pci-dss\u002Frequirement-6":3},{"item":4,"lessons":16,"controls":67,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":12,"official_url":13,"link_label":14,"note":12,"updated_at":15},"pci-dss","requirement-6","Requirement 6.3","Requirement 6: Develop and Maintain Secure Systems and Software",84,"PCI Security Standards Council","**What it asks for.** Requirement 6 of PCI DSS v4.0 covers protecting system components and software from vulnerabilities. It addresses secure development of bespoke and custom software, identifying and ranking vulnerabilities, installing security patches, protecting public facing web applications against attacks and managing changes to system components.\n\n**In practice.** Organisations train developers in secure coding, review code before release, maintain an inventory of bespoke software and third party components, apply critical patches within defined timeframes and protect public facing web applications, for example with an automated technical solution. v4.0 also expects control over payment page scripts. Evidence includes secure development procedures, code review records, patching records and change control documentation.\n\n**Common gaps.** Component inventories for custom software are often incomplete. Payment page script management, newer in v4.0, is a frequent gap for e-commerce merchants.",null,"https:\u002F\u002Fwww.pcisecuritystandards.org\u002Fstandards\u002Fpci-dss\u002F","Read about PCI DSS","2026-10-18T15:18:43.663+00:00",{"total":17,"list":18},82,[19,23,27,31,35,39,43,47,51,55,59,63],{"slug":20,"title":21,"published_at":22},"siteguard-waf-os-command-injection-exploited-for-root-access","SiteGuard WAF OS Command Injection Exploited for Root Access","2026-10-18T16:20:26.047+00:00",{"slug":24,"title":25,"published_at":26},"critical-magento-rce-flaw-demands-immediate-patching","Critical Magento RCE Flaw Demands Immediate Patching","2026-10-16T22:20:34.131+00:00",{"slug":28,"title":29,"published_at":30},"nginx-patches-rce-and-tls-auth-bypass-flaws-including-a-20-year-old-bug","NGINX Patches RCE and TLS Auth Bypass Flaws — Including a 20-Year-Old Bug","2026-10-15T16:21:08.659+00:00",{"slug":32,"title":33,"published_at":34},"critical-pan-os-rce-flaw-exploited-in-the-wild-patch-immediately","Critical PAN-OS RCE Flaw Exploited in the Wild — Patch Immediately","2026-10-15T08:21:02.348+00:00",{"slug":36,"title":37,"published_at":38},"atm-jackpotting-ring-exposes-physical-cyber-security-gaps-in-banking-infrastructure","ATM Jackpotting Ring Exposes Physical & Cyber Security Gaps in Banking Infrastructure","2026-10-08T20:20:59.635+00:00",{"slug":40,"title":41,"published_at":42},"ploutus-atm-malware-developer-arrested-lessons-for-physical-logical-atm-security","Ploutus ATM Malware Developer Arrested — Lessons for Physical & Logical ATM Security","2026-10-06T14:21:58.654+00:00",{"slug":44,"title":45,"published_at":46},"ploutus-atm-jackpotting-malware-exposes-critical-physical-and-logical-atm-security-gaps","Ploutus ATM Jackpotting Malware Exposes Critical Physical and Logical ATM Security Gaps","2026-10-05T14:20:40.141+00:00",{"slug":48,"title":49,"published_at":50},"critical-rce-flaw-in-swift-middleware-threatens-banking-government-systems","Critical RCE Flaw in SWIFT Middleware Threatens Banking & Government Systems","2026-10-02T18:21:48.948+00:00",{"slug":52,"title":53,"published_at":54},"atm-jackpotting-malware-driven-cash-theft-highlights-physical-and-cyber-atm-security-gaps","ATM Jackpotting: Malware-Driven Cash Theft Highlights Physical and Cyber ATM Security Gaps","2026-10-02T16:20:41.59+00:00",{"slug":56,"title":57,"published_at":58},"critical-fortimail-zero-day-exploited-unauthenticated-file-write-risk","Critical FortiMail Zero-Day Exploited: Unauthenticated File Write Risk","2026-10-02T08:20:35.294+00:00",{"slug":60,"title":61,"published_at":62},"self-registration-exploit-leads-to-webshell-implant-on-municipal-recreation-platform","Self-Registration Exploit Leads to Webshell Implant on Municipal Recreation Platform","2026-09-30T16:21:13.611+00:00",{"slug":64,"title":65,"published_at":66},"ai-driven-threat-actors-compromise-27-retailers-steal-600k-credit-card-records","AI-Driven Threat Actors Compromise 27 Retailers, Steal 600K Credit Card Records","2026-09-24T19:21:41.765+00:00",[68,73,78,83,88,93],{"slug":69,"name":70,"problem":71,"stories":72},"patch-management","Automated patch management","Known holes get closed in days, not months.",52,{"slug":74,"name":75,"problem":76,"stories":77},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",50,{"slug":79,"name":80,"problem":81,"stories":82},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",33,{"slug":84,"name":85,"problem":86,"stories":87},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",11,{"slug":89,"name":90,"problem":91,"stories":92},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",8,{"slug":94,"name":95,"problem":96,"stories":97},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",6,[99,105,110,115,120,126,131,136],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","7","Control 7","Continuous Vulnerability Management",65,{"family":106,"item":107,"code":108,"title":109,"together":72},"nist-800-53","si-2","SI-2","Flaw Remediation",{"family":111,"item":112,"code":113,"title":113,"together":114},"itil","overview","ITIL",42,{"family":100,"item":116,"code":117,"title":118,"together":119},"12","Control 12","Network Infrastructure Management",37,{"family":121,"item":122,"code":123,"title":124,"together":125},"gdpr","32","Article 32","Security of processing",35,{"family":106,"item":127,"code":128,"title":129,"together":130},"ra-5","RA-5","Vulnerability Monitoring and Scanning",29,{"family":100,"item":132,"code":133,"title":134,"together":135},"13","Control 13","Network Monitoring and Defense",28,{"family":100,"item":137,"code":138,"title":139,"together":135},"2","Control 2","Inventory and Control of Software Assets"]