Our blog | Matthews Enterprises

Our blog

Apple tightens macOS Full Disk Access after AI agent risk

Matthews Enterprises (PTY) LTD, Francois Matthews

Apple tightens macOS Full Disk Access after AI agent risk

Apple will require explicit consent before macOS apps get Full Disk Access, because AI agents can read mail, messages, and files.

Cybersecurity

Oct 5, 2026

CVE-2026-86360: Dell System Update flaw scores 9.6, root on PowerEdge

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-86360: Dell System Update flaw scores 9.6, root on PowerEdge

Dell System Update before 2.3.0.0 can give an unauthenticated remote attacker root on PowerEdge hosts. Upgrade DSU before the next window.

Cybersecurity

Oct 5, 2026

ShinyHunters: suspected member detained in Jordan

Matthews Enterprises (PTY) LTD, Francois Matthews

ShinyHunters: suspected member detained in Jordan

Jordan detained a suspected ShinyHunters member known as Rey. Sources told Reuters and CBS he is cooperating with the FBI after the group's FBI jobs-site claim.

Cybersecurity

Oct 5, 2026

macOS Full Disk Access: Apple tightens AI agent controls

Matthews Enterprises (PTY) LTD, Francois Matthews

macOS Full Disk Access: Apple tightens AI agent controls

Apple said on 2 October it will add controls so Full Disk Access can only be granted with a very explicit user action, because AI agents raise the risk.

Cybersecurity

Oct 5, 2026

Zammad CVE-2026-102489: KEV due date is today

Matthews Enterprises (PTY) LTD, Francois Matthews

Zammad CVE-2026-102489: KEV due date is today

CISA's remediation deadline for two chained Zammad flaws is 5 October. On version 6.5 and older, a session bug plus a local privilege bug can reach root.

Cybersecurity

Oct 5, 2026

CVE-2026-61500: Rejetto HFS admin session forgery

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-61500: Rejetto HFS admin session forgery

VulnCheck says attackers are already probing CVE-2026-61500, which lets a remote user forge a Rejetto HFS administrator cookie and run code.

Cybersecurity

Oct 5, 2026

Denmark CPR breach: 8.8 million identity records

Matthews Enterprises (PTY) LTD, Francois Matthews

Denmark CPR breach: 8.8 million identity records

Unauthorized parties misused a Danish company's lawful CPR access and reached names, addresses, and ID numbers for about 8.8 million registered people.

Cybersecurity

Oct 5, 2026

CVE-2026-102489: Zammad session flaw chained to root, due 5 October

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-102489: Zammad session flaw chained to root, due 5 October

CISA's remediation date for two exploited Zammad flaws is 5 October. Chained, they go from a helpdesk session to code execution as the zammad user, then to root.

Cybersecurity

Oct 5, 2026

CVE-2026-105215: ZITADEL Login V1 account pre-hijack, CVSS 9.1

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-105215: ZITADEL Login V1 account pre-hijack, CVSS 9.1

ZITADEL Login V1 trusted client-supplied external identity fields before the IdP callback finished. An attacker can pre-create the account a victim later signs into.

Cybersecurity

Oct 5, 2026

CVE-2026-61500: Rejetto HFS admin session forgery, CVSS 9.3

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-61500: Rejetto HFS admin session forgery, CVSS 9.3

Rejetto HTTP File Server 3.0.0 through 3.2.0 signs admin cookies with Math.random(). Attackers are already forging those sessions for remote code execution.

Cybersecurity

Oct 5, 2026

Google OSS VRP paused 1 October after AI bug-report flood

Matthews Enterprises (PTY) LTD, Francois Matthews

Google OSS VRP paused 1 October after AI bug-report flood

Google froze product-vulnerability submissions to its open-source bug bounty on 1 October. Most of the new automated reports were not valid. An update is promised in Q1 2027.

Cybersecurity

Oct 5, 2026

CVE-2026-102489: Zammad zero-day chain, KEV due 5 October

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-102489: Zammad zero-day chain, KEV due 5 October

CISA lists two Zammad flaws that were chained for remote code execution and root. The federal due date is 5 October. DIVD says an agentic attack hit its own instance.

Cybersecurity

Oct 5, 2026

Prev
11
12
13
14
15
Next