Our blog | Matthews Enterprises

Our blog

YOOtheme Pro CVE-2026-102785: CVSS 10.0 RCE leaves webshells in image files

Matthews Enterprises (PTY) LTD, Francois Matthews

YOOtheme Pro CVE-2026-102785: CVSS 10.0 RCE leaves webshells in image files

A signature reuse flaw in YOOtheme Pro's public image handler lets anyone write an executable PNG/PHP polyglot into the media folder. Attackers are leaving backdoors in real JPEGs.

Cybersecurity

Nov 3, 2026

weDevs Project Manager CVE-2026-116512: 9.8 unauthenticated RCE in WordPress

Matthews Enterprises (PTY) LTD, Francois Matthews

weDevs Project Manager CVE-2026-116512: 9.8 unauthenticated RCE in WordPress

Project Manager for WordPress up to 4.1.1 lets anyone run code on the server without logging in. Version 4.1.2 is out and this one should not wait.

Cybersecurity

Nov 3, 2026

Sophos UTM CVE-2026-118633: pre-auth root RCE on end-of-life firewalls

Matthews Enterprises (PTY) LTD, Francois Matthews

Sophos UTM CVE-2026-118633: pre-auth root RCE on end-of-life firewalls

A path traversal in the UTM email proxy lets an unauthenticated attacker run commands as root. UTM is end-of-life, so the patch is manual and there is no workaround.

Cybersecurity

Nov 3, 2026

Siemens SIMATIC IoT2050 CVE-2026-58115: CVSS 10.0, exploited and no login required

Matthews Enterprises (PTY) LTD, Francois Matthews

Siemens SIMATIC IoT2050 CVE-2026-58115: CVSS 10.0, exploited and no login required

VulnCheck has seen live attacks on a CVSS 10.0 hole in Siemens SIMATIC IoT2050 industrial gateways. Node-RED on the device accepts commands from anyone who can reach it.

Cybersecurity

Nov 3, 2026

CryptoPayment Gateway CVE-2026-81648: CVSS 10.0, no patch, exploit attempts underway

Matthews Enterprises (PTY) LTD, Francois Matthews

CryptoPayment Gateway CVE-2026-81648: CVSS 10.0, no patch, exploit attempts underway

A WordPress payment plugin with a 10.0 unauthenticated flaw has no fixed version, and researchers say attackers are already probing for it. Deactivating it is the only fix.

Cybersecurity

Nov 3, 2026

XCPE backdoor: 1.3 million Android TV boxes left the factory infected

Matthews Enterprises (PTY) LTD, Francois Matthews

XCPE backdoor: 1.3 million Android TV boxes left the factory infected

Google says Videostrong built the x.cpe backdoor into firmware and sold access to criminals. 1.3 million boxes enrolled, and a restart brings it back.

Cybersecurity

Nov 2, 2026

Danfoss AK-SM 800A: 115 supermarkets had freezers defrosted overnight

Matthews Enterprises (PTY) LTD, Francois Matthews

Danfoss AK-SM 800A: 115 supermarkets had freezers defrosted overnight

A second wave hit more than 115 stores in six countries after the French attacks in October. The controller flaw was fixed in firmware 4.3.1.

Cybersecurity

Nov 2, 2026

Cursor served a tampered Claude Code extension that opened a reverse SSH backdoor

Matthews Enterprises (PTY) LTD, Francois Matthews

Cursor served a tampered Claude Code extension that opened a reverse SSH backdoor

Two tampered builds of the Claude Code extension sat in Cursor's marketplace for about 11 hours, carrying an SSH key, a reverse tunnel and persistence.

Cybersecurity

Nov 2, 2026

Microsoft Teams help-desk impersonation: AD CS ESC1 and ESC8 abuse ends in domain certificates

Matthews Enterprises (PTY) LTD, Francois Matthews

Microsoft Teams help-desk impersonation: AD CS ESC1 and ESC8 abuse ends in domain certificates

Attackers posed as IT support on Teams, walked users into Quick Assist, then abused certificate templates and NTLM relay to reach domain certificates.

Cybersecurity

Nov 2, 2026

TeamViewer CVE-2026-111585: a malicious host can run code on the technician's PC

Matthews Enterprises (PTY) LTD, Francois Matthews

TeamViewer CVE-2026-111585: a malicious host can run code on the technician's PC

An integer overflow in TeamViewer's screen decompression lets an attacker-controlled host take over the viewer's machine during an ordinary support session. Version 15.83 closes it.

Cybersecurity

Nov 2, 2026

Ivanti Connect Secure CVE-2026-111357: privilege escalation to root, exploited since 1 October

Matthews Enterprises (PTY) LTD, Francois Matthews

Ivanti Connect Secure CVE-2026-111357: privilege escalation to root, exploited since 1 October

Ivanti patched two more Connect Secure flaws chained with an October authentication bypass to reach root on fully patched gateways. No malware was dropped; the device was re-exploited for every command.

Cybersecurity

Nov 2, 2026

National Credit Regulator cyberattack: Auditor-General finds no isolated off-site backups

Matthews Enterprises (PTY) LTD, Francois Matthews

National Credit Regulator cyberattack: Auditor-General finds no isolated off-site backups

The Auditor-General could not verify the National Credit Regulator's first-half performance targets because a cyberattack destroyed the supporting records and no isolated off-site backup existed to restore them.

Cybersecurity

Nov 2, 2026

Prev
1
2
3
4
5
Next