Our blog | Matthews Enterprises

Our blog

CVE-2026-21589: unauthenticated file read on 8 Atlassian products

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-21589: unauthenticated file read on 8 Atlassian products

Attackers started probing CVE-2026-21589 within hours of a public write-up. Self-hosted Jira, Confluence, and Bitbucket Data Center need the 5 October patches.

Cybersecurity

Oct 7, 2026

PoeLLM malware hits 2,100 exposed AI servers

Matthews Enterprises (PTY) LTD, Francois Matthews

PoeLLM malware hits 2,100 exposed AI servers

Lumen's Black Lotus Labs says PoeLLM has compromised more than 2,100 servers and peaked near 800 active hosts in a single day.

Cybersecurity

Oct 7, 2026

CVE-2026-91140: Progress DataDirect AI agent command injection

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-91140: Progress DataDirect AI agent command injection

A crafted OpenAPI or Swagger file can run operating system commands in Progress DataDirect's early-access AI model generator agents.

Cybersecurity

Oct 7, 2026

FortiBleed: FBI says 86,644 Fortinet device credentials still in play

Matthews Enterprises (PTY) LTD, Francois Matthews

FortiBleed: FBI says 86,644 Fortinet device credentials still in play

The FBI and Secret Service say FortiBleed is still scanning exposed FortiGate firewalls and SSL VPN gateways with stolen credentials.

Cybersecurity

Oct 7, 2026

CVE-2026-102255: CVSS 10 SSRF in SonicWall SMA1000

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-102255: CVSS 10 SSRF in SonicWall SMA1000

SonicWall shipped hotfixes for a CVSS 10 unauthenticated SSRF in SMA1000 WorkPlace. No exploitation reported yet. Prior SMA1000 bugs were hit fast.

Cybersecurity

Oct 7, 2026

LunexStealer: 100-plus sites push fake Cloudflare checks

Matthews Enterprises (PTY) LTD, Francois Matthews

LunexStealer: 100-plus sites push fake Cloudflare checks

CERT-UA says more than 100 compromised sites show a fake Cloudflare check that tells Windows users to run a command and install LunexStealer.

Cybersecurity

Oct 7, 2026

CVE-2026-21589: unauthenticated file read on Atlassian Data Center

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-21589: unauthenticated file read on Atlassian Data Center

Unauthenticated attackers can read named files in self-hosted Jira, Confluence, and Bitbucket. Honeypots saw attempts two hours after a public write-up.

Cybersecurity

Oct 7, 2026

Fake ChatGPT and Gemini ad portals steal Google and Okta MFA

Matthews Enterprises (PTY) LTD, Francois Matthews

Fake ChatGPT and Gemini ad portals steal Google and Okta MFA

A human-operated phishing kit impersonates ChatGPT, Gemini, Claude and Muse ad tools, then steals Google and Okta MFA inside a fake browser window. Media-buyer accounts are the target.

Cybersecurity

Oct 7, 2026

Langflow CVE-2026-0768: unauthenticated code execution under active scan

Matthews Enterprises (PTY) LTD, Francois Matthews

Langflow CVE-2026-0768: unauthenticated code execution under active scan

F5 Labs recorded 405 scans in September for CVE-2026-0768, an unauthenticated Langflow bug that runs attacker Python. Internet-facing instances should be treated as exposed.

Cybersecurity

Oct 7, 2026

Atlassian CVE-2026-21589: unauthenticated file access, CVSS 9.3

Matthews Enterprises (PTY) LTD, Francois Matthews

Atlassian CVE-2026-21589: unauthenticated file access, CVSS 9.3

CVE-2026-21589 scores 9.3 and hits eight Atlassian Data Center products. No in-the-wild exploitation has been reported yet.

Cybersecurity

Oct 7, 2026

Nikkei Microsoft 365 account sent 9,000 phishing emails after takeover

Matthews Enterprises (PTY) LTD, Francois Matthews

Nikkei Microsoft 365 account sent 9,000 phishing emails after takeover

Nikkei says one breached Microsoft 365 account sent about 9,000 phishing emails on 30 September. A Google account leak hit 1,646 people.

Cybersecurity

Oct 7, 2026

Ninja Forms CVE-2026-94504 exploited on a plugin used by 500,000 sites

Matthews Enterprises (PTY) LTD, Francois Matthews

Ninja Forms CVE-2026-94504 exploited on a plugin used by 500,000 sites

Attackers are using stored XSS in Ninja Forms and a WooCommerce plugin to install a backdoor and a hidden administrator the owner cannot see.

Cybersecurity

Oct 7, 2026

Prev
8
9
10
11
12
Next