Our blog | Matthews Enterprises

Our blog

Xen XSA-523 CVE-2026-102703: one guest can read and write Dom0 memory

Matthews Enterprises (PTY) LTD, Francois Matthews

Xen XSA-523 CVE-2026-102703: one guest can read and write Dom0 memory

A malicious guest can read and write the memory of every other guest, including Dom0. Patches exist, there is no mitigation, and XCP-ng and XenServer hosts wait on their vendor.

Cybersecurity

Nov 4, 2026

mSecure: vendor tells every user to change stored passwords, reset 2FA and drop passkeys

Matthews Enterprises (PTY) LTD, Francois Matthews

mSecure: vendor tells every user to change stored passwords, reset 2FA and drop passkeys

mSeven Software detected suspicious activity in mSecure and told current and former users to rotate everything in the vault, while declining to say what was reached.

Cybersecurity

Nov 4, 2026

CVE-2025-43529 and CVE-2026-3910: zero-click iOS and Android exploits in an APT29 watering hole

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2025-43529 and CVE-2026-3910: zero-click iOS and Android exploits in an APT29 watering hole

A Russian group profiles visitors on compromised websites, then fires already-patched iOS and Chrome exploits with no click required to lift WhatsApp, Keychain and browser data.

Cybersecurity

Nov 4, 2026

SonicWall GMS CVE-2026-109593: 9.1 file read with no patch coming

Matthews Enterprises (PTY) LTD, Francois Matthews

SonicWall GMS CVE-2026-109593: 9.1 file read with no patch coming

SonicWall has published two GMS flaws and confirmed no fix is coming, because the product is end-of-life. The unauthenticated one scores 9.1.

Cybersecurity

Nov 4, 2026

Easy Digital Downloads CVE-2026-120538: guest checkout hands over admin

Matthews Enterprises (PTY) LTD, Francois Matthews

Easy Digital Downloads CVE-2026-120538: guest checkout hands over admin

An attacker who starts a PayPal guest checkout with an administrator's email address can finish it holding that administrator's session. EDD 3.7.3 closes it.

Cybersecurity

Nov 4, 2026

GitLab CVE-2026-97229: CVSS 10.0 CI/CD flaw, 1,000 servers still exposed

Matthews Enterprises (PTY) LTD, Francois Matthews

GitLab CVE-2026-97229: CVSS 10.0 CI/CD flaw, 1,000 servers still exposed

An integer overflow in GitLab's CI/CD regex compiler gives unauthenticated attackers code execution. CISA added it to KEV and 1,000 exposed servers are still unpatched.

Cybersecurity

Nov 4, 2026

Synology C3RB3R ransomware: 380,000 exposed NAS devices, old DSM to blame

Matthews Enterprises (PTY) LTD, Francois Matthews

Synology C3RB3R ransomware: 380,000 exposed NAS devices, old DSM to blame

Synology says attackers are using a flaw patched in December 2024 to encrypt NAS devices and demand payment. The fix has been available for almost two years.

Cybersecurity

Nov 4, 2026

Barracuda ESG CVE-2026-116606: 9.3 auth bypass that ends in root

Matthews Enterprises (PTY) LTD, Francois Matthews

Barracuda ESG CVE-2026-116606: 9.3 auth bypass that ends in root

An authentication bypass on Barracuda's email gateway lets an unauthenticated attacker rewrite the appliance configuration, then a second flaw turns admin rights into root.

Cybersecurity

Nov 4, 2026

cPGuard 5.88.12-5.88.19 pushed a backdoor through its own updater

Matthews Enterprises (PTY) LTD, Francois Matthews

cPGuard 5.88.12-5.88.19 pushed a backdoor through its own updater

OPSSHIELD lost control of the CDN that serves cPGuard updates. Builds 5.88.12 to 5.88.19 carried a root-level script that copied password hashes, MySQL config and root SSH files off the box.

Cybersecurity

Nov 3, 2026

s2Member CVE-2026-86596: CVSS 9.8 code execution through the PayPal IPN field

Matthews Enterprises (PTY) LTD, Francois Matthews

s2Member CVE-2026-86596: CVSS 9.8 code execution through the PayPal IPN field

A payment field in s2Member can be reassembled into a PHP opener before it reaches a template. Wordfence rates the flaw 9.8 and the fix is build 261001.

Cybersecurity

Nov 3, 2026

WordPress CVE-2026-119977: unauthenticated RCE in the core update window

Matthews Enterprises (PTY) LTD, Francois Matthews

WordPress CVE-2026-119977: unauthenticated RCE in the core update window

WordPress 7.1.4 closes an unauthenticated code execution bug in the core update process. Attackers are already polling the staged installer paths it leaves behind.

Cybersecurity

Nov 3, 2026

Brotli CVE-2026-111497: 9.8 decoder flaw in Node.js, .NET and PowerShell

Matthews Enterprises (PTY) LTD, Francois Matthews

Brotli CVE-2026-111497: 9.8 decoder flaw in Node.js, .NET and PowerShell

An out-of-bounds write in the Brotli decoder reaches every runtime that unpacks compressed data. Node.js, .NET and PowerShell 7 all shipped fixes; end-of-life lines did not.

Cybersecurity

Nov 3, 2026

Prev
1
2
3
4
5
Next