Our blog | Matthews Enterprises

Our blog

GitHub wfx-loot campaign stole CI secrets from 1,835 repositories

Matthews Enterprises (PTY) LTD, Francois Matthews

GitHub wfx-loot campaign stole CI secrets from 1,835 repositories

A probe pull request titled docs: dependency audit notes went into 61,764 repositories. Where the follow-up workflow ran, CI secrets and cloud roles were taken.

Cybersecurity

Nov 13, 2026

ScreenConnect RMM+ flaw: rogue clients on 288 MSP-managed endpoints

Matthews Enterprises (PTY) LTD, Francois Matthews

ScreenConnect RMM+ flaw: rogue clients on 288 MSP-managed endpoints

An extension that accepts a blank access key let an operator install rogue ScreenConnect clients on 288 endpoints in 90 minutes, with no login recorded on the panel.

Cybersecurity

Nov 13, 2026

Google Workspace session hijack: calendar invites defeat MFA codes

Matthews Enterprises (PTY) LTD, Francois Matthews

Google Workspace session hijack: calendar invites defeat MFA codes

Attackers are reverse-proxying the real Google sign-in page and relaying each second factor to Google in real time, so the session is captured even when the victim approves a genuine prompt.

Cybersecurity

Nov 13, 2026

wpForo CVE-2026-119155: SQL injection on 20,000 WordPress forums, no login needed

Matthews Enterprises (PTY) LTD, Francois Matthews

wpForo CVE-2026-119155: SQL injection on 20,000 WordPress forums, no login needed

A time-based SQL injection in the wpForo forum plugin is being used against sites that have not moved to 3.2.3, and the token an attacker needs is printed on any public forum page.

Cybersecurity

Nov 13, 2026

Check Point CVE-2026-123039: gateways rooted, TSGA backdoor, ESXi wiper

Matthews Enterprises (PTY) LTD, Francois Matthews

Check Point CVE-2026-123039: gateways rooted, TSGA backdoor, ESXi wiper

Attackers used the PHP2Shell flaws to enter Check Point gateways, escalated to root with a Gaia OS flaw, installed the TSGA backdoor and wiped an ESXi host. The escalation flaw affects R81.20 through R82.20.

Cybersecurity

Nov 13, 2026

Microsoft 365 Copilot token theft: Luna Moth vishing beats MFA

Matthews Enterprises (PTY) LTD, Francois Matthews

Microsoft 365 Copilot token theft: Luna Moth vishing beats MFA

The extortion group is calling law firms again, posing as IT support, and walking employees through copying a Microsoft Graph token out of Copilot. Then it downloads thousands of files in about an hour.

Cybersecurity

Nov 13, 2026

Windows SignDrop zero-day: SYSTEM from a standard user, no patch yet

Matthews Enterprises (PTY) LTD, Francois Matthews

Windows SignDrop zero-day: SYSTEM from a standard user, no patch yet

Working exploit code turns a standard Windows user into SYSTEM by abusing the CLFS log signing feature Microsoft added in 2025, and it can switch off antivirus tamper protection. No CVE, no patch.

Cybersecurity

Nov 13, 2026

Bob Shop breach exposes card numbers and expiry dates for SA online shoppers

Matthews Enterprises (PTY) LTD, Francois Matthews

Bob Shop breach exposes card numbers and expiry dates for SA online shoppers

Bob Group says an intruder reached the Bob Shop database on 30 and 31 October. Card numbers were encrypted, but the key was copied too, so they count as exposed.

Cybersecurity

Nov 13, 2026

N-able N-central 4EverAble2Shell: root RCE survives Hotfix 2, 21 servers compromised

Matthews Enterprises (PTY) LTD, Francois Matthews

N-able N-central 4EverAble2Shell: root RCE survives Hotfix 2, 21 servers compromised

A public exploit chain gave root on N-central appliances, and 19 of the 21 servers found mining were already on N-able's latest hotfix. South African hosts were among them.

Cybersecurity

Nov 13, 2026

Windows 11 KB5132061 fails with 0x800f0989 on devices that took KB5127936

Matthews Enterprises (PTY) LTD, Francois Matthews

Windows 11 KB5132061 fails with 0x800f0989 on devices that took KB5127936

The November 2026 Windows security updates stall and fail with 0x800f0989 on devices that took the October preview KB5127936. Microsoft is pushing an automatic repair.

Cybersecurity

Nov 12, 2026

Europol seizes 235 servers behind Gootloader, CastleRAT and StealC

Matthews Enterprises (PTY) LTD, Francois Matthews

Europol seizes 235 servers behind Gootloader, CastleRAT and StealC

Police seized 235 servers and 257 domains used by Gootloader, CastleRAT and StealC, and found 6.4 million stolen credential sets on them. The infected machines stay infected.

Cybersecurity

Nov 12, 2026

Stats SA job-seeker data sells for R34,000 as SA breach reports pass 8,000

Matthews Enterprises (PTY) LTD, Francois Matthews

Stats SA job-seeker data sells for R34,000 as SA breach reports pass 8,000

An archive of 453,362 job-seeker records from the Stats SA breach is now listed at about R34,000. The regulator has passed 8,000 breach notifications.

Cybersecurity

Nov 12, 2026

Prev
1
2
3
4
5
Next