Our blog | Matthews Enterprises

Our blog

D-Link DGS-3130: unpatched DDP flaws in SMB switches, no firmware fix

Matthews Enterprises (PTY) LTD, Francois Matthews

D-Link DGS-3130: unpatched DDP flaws in SMB switches, no firmware fix

D-Link has no firmware for a set of flaws in its SMB managed switch line. The documented mitigation is to switch off the discovery protocol the bugs live in.

Cybersecurity

Nov 8, 2026

NightsBridge breach: 10,000-property SA booking platform hit by AI-driven attack

Matthews Enterprises (PTY) LTD, Francois Matthews

NightsBridge breach: 10,000-property SA booking platform hit by AI-driven attack

A South African platform sitting between 10,000 properties and the booking sites was breached on 2 November. The stolen fields are exactly what a convincing booking spoof needs.

Cybersecurity

Nov 8, 2026

D-Link DGS-3130-30TS: DDP flaws stay unpatched with no firmware release date

Matthews Enterprises (PTY) LTD, Francois Matthews

D-Link DGS-3130-30TS: DDP flaws stay unpatched with no firmware release date

D-Link published mitigations for unpatched flaws in the DGS-3130-30TS switch and said there is no corrective firmware yet. Disabling DDP is the interim control.

Cybersecurity

Nov 8, 2026

SonicWall CVE-2026-19868: SAML bypass skips MFA on SSL-VPN logins and is already exploited

Matthews Enterprises (PTY) LTD, Francois Matthews

SonicWall CVE-2026-19868: SAML bypass skips MFA on SSL-VPN logins and is already exploited

SonicWall investigated an attack abusing a SonicOS SSL-VPN flaw that lets a user with alternate credentials skip SAML and the MFA built on it. CISA added it to KEV the same day.

Cybersecurity

Nov 8, 2026

OpenSSH 10.6p2: musl servers accept a 257-byte password on key-only accounts

Matthews Enterprises (PTY) LTD, Francois Matthews

OpenSSH 10.6p2: musl servers accept a 257-byte password on key-only accounts

Alpine's sshd accepts a 257-byte password for any account with no password set, no guessing needed. Patch 10.6p2 or turn password logins off.

Cybersecurity

Nov 5, 2026

WatchGuard AuthPoint Gateway: CVSS 9.2 flaw lets attackers forge MFA results

Matthews Enterprises (PTY) LTD, Francois Matthews

WatchGuard AuthPoint Gateway: CVSS 9.2 flaw lets attackers forge MFA results

WatchGuard patched four AuthPoint Gateway flaws, including a 9.2 unauthenticated denial of service and an LDAP callback whose authentication result can be rewritten.

Cybersecurity

Nov 5, 2026

BookIt CVE-2026-62048: unauthenticated SQL injection at 9.3, patch 2.6.0.7

Matthews Enterprises (PTY) LTD, Francois Matthews

BookIt CVE-2026-62048: unauthenticated SQL injection at 9.3, patch 2.6.0.7

Patchstack rates the booking plugin flaw 9.3 with no login required, so the same database that holds WordPress accounts holds the customer bookings.

Cybersecurity

Nov 5, 2026

GhostMap: one Android APK, no permissions, an endless reboot loop

Matthews Enterprises (PTY) LTD, Francois Matthews

GhostMap: one Android APK, no permissions, an endless reboot loop

Bitdefender put a Pixel 10 into a 110-cycle boot loop with an APK that requests no permissions and never has to be opened. Google closed the report without a fix.

Cybersecurity

Nov 5, 2026

Windows Paint CVE-2026-83844: 8.1 RCE and the fix that is not arriving

Matthews Enterprises (PTY) LTD, Francois Matthews

Windows Paint CVE-2026-83844: 8.1 RCE and the fix that is not arriving

A crafted image can run code through the Paint app built into Windows 11. Microsoft shipped a fix in October, but many PCs are still sitting on the vulnerable build.

Cybersecurity

Nov 5, 2026

Android CVE-2026-58868: zero-click RCE fixed in the November 2026 patch level

Matthews Enterprises (PTY) LTD, Francois Matthews

Android CVE-2026-58868: zero-click RCE fixed in the November 2026 patch level

Google's November bulletin closes a critical Framework RCE that needs no tap, no link and no permission prompt. Most phones will not have it for weeks.

Cybersecurity

Nov 5, 2026

ACF Extended PRO CVE-2026-120534: 9.8 unauthenticated RCE, and 0.9.2.7 is not the fix

Matthews Enterprises (PTY) LTD, Francois Matthews

ACF Extended PRO CVE-2026-120534: 9.8 unauthenticated RCE, and 0.9.2.7 is not the fix

A premium WordPress add-on injects code for anyone who can reach the site, no login needed. The version most guides call the fix still carries two more critical holes.

Cybersecurity

Nov 5, 2026

Apple CVE-2024-27834 joins CISA KEV: iOS below 17.5 is the gap

Matthews Enterprises (PTY) LTD, Francois Matthews

Apple CVE-2024-27834 joins CISA KEV: iOS below 17.5 is the gap

A two-year-old WebKit bug is now on the exploited list. Anything still below iOS 17.5 or macOS 14.5 is carrying a step that real exploit chains use.

Cybersecurity

Nov 5, 2026

Prev
1
2
3
4
5
Next