Our blog | Matthews Enterprises

Our blog

OpenSSH 10.6p2: musl servers accept a 257-byte password on key-only accounts

Matthews Enterprises (PTY) LTD, Francois Matthews

OpenSSH 10.6p2: musl servers accept a 257-byte password on key-only accounts

Alpine's sshd accepts a 257-byte password for any account with no password set, no guessing needed. Patch 10.6p2 or turn password logins off.

Cybersecurity

Nov 5, 2026

WatchGuard AuthPoint Gateway: CVSS 9.2 flaw lets attackers forge MFA results

Matthews Enterprises (PTY) LTD, Francois Matthews

WatchGuard AuthPoint Gateway: CVSS 9.2 flaw lets attackers forge MFA results

WatchGuard patched four AuthPoint Gateway flaws, including a 9.2 unauthenticated denial of service and an LDAP callback whose authentication result can be rewritten.

Cybersecurity

Nov 5, 2026

BookIt CVE-2026-62048: unauthenticated SQL injection at 9.3, patch 2.6.0.7

Matthews Enterprises (PTY) LTD, Francois Matthews

BookIt CVE-2026-62048: unauthenticated SQL injection at 9.3, patch 2.6.0.7

Patchstack rates the booking plugin flaw 9.3 with no login required, so the same database that holds WordPress accounts holds the customer bookings.

Cybersecurity

Nov 5, 2026

GhostMap: one Android APK, no permissions, an endless reboot loop

Matthews Enterprises (PTY) LTD, Francois Matthews

GhostMap: one Android APK, no permissions, an endless reboot loop

Bitdefender put a Pixel 10 into a 110-cycle boot loop with an APK that requests no permissions and never has to be opened. Google closed the report without a fix.

Cybersecurity

Nov 5, 2026

Windows Paint CVE-2026-83844: 8.1 RCE and the fix that is not arriving

Matthews Enterprises (PTY) LTD, Francois Matthews

Windows Paint CVE-2026-83844: 8.1 RCE and the fix that is not arriving

A crafted image can run code through the Paint app built into Windows 11. Microsoft shipped a fix in October, but many PCs are still sitting on the vulnerable build.

Cybersecurity

Nov 5, 2026

Android CVE-2026-58868: zero-click RCE fixed in the November 2026 patch level

Matthews Enterprises (PTY) LTD, Francois Matthews

Android CVE-2026-58868: zero-click RCE fixed in the November 2026 patch level

Google's November bulletin closes a critical Framework RCE that needs no tap, no link and no permission prompt. Most phones will not have it for weeks.

Cybersecurity

Nov 5, 2026

ACF Extended PRO CVE-2026-120534: 9.8 unauthenticated RCE, and 0.9.2.7 is not the fix

Matthews Enterprises (PTY) LTD, Francois Matthews

ACF Extended PRO CVE-2026-120534: 9.8 unauthenticated RCE, and 0.9.2.7 is not the fix

A premium WordPress add-on injects code for anyone who can reach the site, no login needed. The version most guides call the fix still carries two more critical holes.

Cybersecurity

Nov 5, 2026

Apple CVE-2024-27834 joins CISA KEV: iOS below 17.5 is the gap

Matthews Enterprises (PTY) LTD, Francois Matthews

Apple CVE-2024-27834 joins CISA KEV: iOS below 17.5 is the gap

A two-year-old WebKit bug is now on the exploited list. Anything still below iOS 17.5 or macOS 14.5 is carrying a step that real exploit chains use.

Cybersecurity

Nov 5, 2026

CVE-2026-98432: Linux IPv4 TCP flaw puts RouterOS 7 and Ubuntu at risk

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-98432: Linux IPv4 TCP flaw puts RouterOS 7 and Ubuntu at risk

MikroTik has confirmed RouterOS 7 inherits a CVSS 9.8 use-after-free in the Linux IPv4 TCP stack. Routers with management services open to the internet are the exposed ones.

Cybersecurity

Nov 5, 2026

Chrome 157: 213 fixes, seven critical memory bugs in one update

Matthews Enterprises (PTY) LTD, Francois Matthews

Chrome 157: 213 fixes, seven critical memory bugs in one update

Google's Chrome 157 stable release closes 213 vulnerabilities, seven of them critical memory safety bugs in WebGPU and graphics code. No in-the-wild exploitation is known.

Cybersecurity

Nov 4, 2026

Google Calendar phishing steals live sessions and walks past MFA

Matthews Enterprises (PTY) LTD, Francois Matthews

Google Calendar phishing steals live sessions and walks past MFA

A campaign running since mid-August delivers phishing through Google Calendar invites and proxies the real sign-in page, capturing the session after MFA is approved.

Cybersecurity

Nov 4, 2026

Zyxel GS1900 CVE-2026-107441: 8.8 command execution that survived the June patch

Matthews Enterprises (PTY) LTD, Francois Matthews

Zyxel GS1900 CVE-2026-107441: 8.8 command execution that survived the June patch

Ten GS1900 models take an unauthenticated HTTP request that ends in OS commands. The June firmware everyone treated as the fix is still exploitable.

Cybersecurity

Nov 4, 2026

Prev
1
2
3
4
5
Next