Our blog | Matthews Enterprises

Our blog

CVE-2026-39919: Ghostscript CVSS 9.8 PDF heap overflow

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-39919: Ghostscript CVSS 9.8 PDF heap overflow

Ghostscript CVE-2026-39919 is a CVSS 9.8 heap overflow in JPEG 2000 decoding. A crafted PDF can reach code execution on servers that build thumbnails, including WordPress. Fixed in 10.08.0.

Cybersecurity

Oct 14, 2026

npm SlugFest: 1,500+ packages exposed via Trusted Publishing

Matthews Enterprises (PTY) LTD, Francois Matthews

npm SlugFest: 1,500+ packages exposed via Trusted Publishing

Bloom Security says npm Trusted Publishing trusted GitHub repository names, not permanent IDs. More than 1,500 packages were exposed. GitHub's fix expires unvalidated configs after 48 hours.

Cybersecurity

Oct 14, 2026

CVE-2026-96951: Windows Shell MOTW bypass exploited, patch by 16 Oct

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-96951: Windows Shell MOTW bypass exploited, patch by 16 Oct

Microsoft's October 2026 Patch Tuesday fixes 1,413 flaws. CVE-2026-96951 is the one already exploited: a Windows Shell bypass of Mark of the Web. CISA's federal due date is 16 October.

Cybersecurity

Oct 14, 2026

CVE-2026-105445: Docker Hub PAT reassigned to another user

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-105445: Docker Hub PAT reassigned to another user

Docker Hub CVE-2026-105445 let an attacker reassign their own personal access token to another user during account conversion. Docker says it found no exploitation. Check whether you got the 2 October email.

Cybersecurity

Oct 14, 2026

CVE-2026-104935: Ivanti Connect Secure auth bypass exploited since Oct 3

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-104935: Ivanti Connect Secure auth bypass exploited since Oct 3

Ivanti Connect Secure CVE-2026-104935 is in CISA KEV. Attackers chained it for unauthenticated root on fully patched appliances. The privilege-escalation piece is still unfixed.

Cybersecurity

Oct 14, 2026

LG webOS local-network root chain, no PIN required

Matthews Enterprises (PTY) LTD, Francois Matthews

LG webOS local-network root chain, no PIN required

SSD disclosed a three-stage LG webOS chain that gives root on tested smart TVs from the same local network, with no PIN and no owner interaction. LG has issued a fix.

Cybersecurity

Oct 13, 2026

Ivanti Connect Secure CVE-2026-104935 zero-day, CVSS 8.6

Matthews Enterprises (PTY) LTD, Francois Matthews

Ivanti Connect Secure CVE-2026-104935 zero-day, CVSS 8.6

Ivanti says a limited number of Connect Secure customers are already hit by CVE-2026-104935, an authentication-bypass zero-day that runs commands with no login.

Cybersecurity

Oct 13, 2026

SAP Cloud SDK CVE-2026-89111 CVSS 10 OAuth2 SSRF

Matthews Enterprises (PTY) LTD, Francois Matthews

SAP Cloud SDK CVE-2026-89111 CVSS 10 OAuth2 SSRF

SAP's October patch day includes CVE-2026-89111, a CVSS 10 OAuth2 SSRF in the Cloud SDK for Python that can exfiltrate client credentials from multi-tenant BTP apps.

Cybersecurity

Oct 13, 2026

NetScaler CVE-2026-107406: CVSS 9.5 SAML memory overflow

Matthews Enterprises (PTY) LTD, Francois Matthews

NetScaler CVE-2026-107406: CVSS 9.5 SAML memory overflow

Citrix patched CVE-2026-107406, a CVSS 9.5 memory overflow in NetScaler SAML handling that can lead to remote code execution or a crash. No workaround.

Cybersecurity

Oct 13, 2026

Danfoss fridge controllers hijacked at 500 French stores

Matthews Enterprises (PTY) LTD, Francois Matthews

Danfoss fridge controllers hijacked at 500 French stores

Attackers remotely forced legacy Danfoss refrigeration controllers into continuous defrost at more than 500 French supermarkets, spoiling stock and reaching 50 C.

Cybersecurity

Oct 13, 2026

Ledger LTE implant stole recovery phrases via CryptoBilis

Matthews Enterprises (PTY) LTD, Francois Matthews

Ledger LTE implant stole recovery phrases via CryptoBilis

Ledger confirmed a covert LTE implant in signers sold by Southeast Asian reseller CryptoBilis. The chip read the 24-word recovery phrase off the screen.

Cybersecurity

Oct 13, 2026

GitLab CVE-2026-97229: CVSS 10 unauthenticated RCE

Matthews Enterprises (PTY) LTD, Francois Matthews

GitLab CVE-2026-97229: CVSS 10 unauthenticated RCE

A CVSS 10 integer overflow in GitLab's CI/CD regex compiler lets an unauthenticated attacker run code on self-managed CE and EE. Cloud is already patched.

Cybersecurity

Oct 13, 2026

Prev
12
13
14
15
16
Next