Our blog | Matthews Enterprises

Our blog

curl CVE-2026-92392 HTTP/2 upload flaw fixed in 8.23.0

Matthews Enterprises (PTY) LTD, Francois Matthews

curl CVE-2026-92392 HTTP/2 upload flaw fixed in 8.23.0

curl 8.23.0 fixes CVE-2026-92392, a High use-after-free on HTTP/2 uploads. A malicious server can corrupt client memory. A public proof of concept shows code execution under tight conditions.

Cybersecurity

Oct 14, 2026

CVE-2026-39919: Ghostscript PDF overflow can run code

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-39919: Ghostscript PDF overflow can run code

A crafted PDF can overflow Ghostscript's JPEG 2000 decoder and run code on servers that build thumbnails. Fixed in 10.08.0. No exploitation seen yet.

Cybersecurity

Oct 14, 2026

SAP October 2026: four critical flaws, one scored CVSS 10

Matthews Enterprises (PTY) LTD, Francois Matthews

SAP October 2026: four critical flaws, one scored CVSS 10

SAP shipped 22 notes on 13 October, four of them critical. One is an OAuth2 SSRF in Cloud SDK for Python scored 10. No exploitation reported.

Cybersecurity

Oct 14, 2026

CVE-2026-96951: Windows MotW bypass exploited, patch by 16 Oct

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-96951: Windows MotW bypass exploited, patch by 16 Oct

Microsoft patched an exploited Windows Shell flaw that skips Mark of the Web checks. CISA wants it fixed by 16 October.

Cybersecurity

Oct 14, 2026

CVE-2026-74580: Linux vhost flaw gives local users root

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-74580: Linux vhost flaw gives local users root

A nine-year-old Linux vhost bug, found with an AI research pipeline, gives local root and a guest-to-host write. No public exploitation yet.

Cybersecurity

Oct 14, 2026

Chrome 155 patches 37 flaws, 7 critical

Matthews Enterprises (PTY) LTD, Francois Matthews

Chrome 155 patches 37 flaws, 7 critical

Google shipped Chrome 155.0.8059.79 with fixes for 37 vulnerabilities, including 7 critical memory bugs. Anthropic reported 15 of them with Claude. Update now.

Cybersecurity

Oct 14, 2026

OpenAI employee arrested over hidden conference-room recorder

Matthews Enterprises (PTY) LTD, Francois Matthews

OpenAI employee arrested over hidden conference-room recorder

The FBI arrested a 35-year-old OpenAI engineer after the company found a hidden recording device in an executive conference-room television. OpenAI fired him and used its own models to trace the device.

Cybersecurity

Oct 14, 2026

CVE-2026-107656: FortiSandbox auth bypass, CVSS 9.6

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-107656: FortiSandbox auth bypass, CVSS 9.6

Fortinet disclosed CVE-2026-107656, a CVSS 9.6 authentication bypass in the FortiSandbox GUI. A remote attacker needs no login. Patch 5.0 and 4.4 now.

Cybersecurity

Oct 14, 2026

CVE-2026-39919: Ghostscript CVSS 9.8 PDF heap overflow

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-39919: Ghostscript CVSS 9.8 PDF heap overflow

Ghostscript CVE-2026-39919 is a CVSS 9.8 heap overflow in JPEG 2000 decoding. A crafted PDF can reach code execution on servers that build thumbnails, including WordPress. Fixed in 10.08.0.

Cybersecurity

Oct 14, 2026

npm SlugFest: 1,500+ packages exposed via Trusted Publishing

Matthews Enterprises (PTY) LTD, Francois Matthews

npm SlugFest: 1,500+ packages exposed via Trusted Publishing

Bloom Security says npm Trusted Publishing trusted GitHub repository names, not permanent IDs. More than 1,500 packages were exposed. GitHub's fix expires unvalidated configs after 48 hours.

Cybersecurity

Oct 14, 2026

CVE-2026-96951: Windows Shell MOTW bypass exploited, patch by 16 Oct

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-96951: Windows Shell MOTW bypass exploited, patch by 16 Oct

Microsoft's October 2026 Patch Tuesday fixes 1,413 flaws. CVE-2026-96951 is the one already exploited: a Windows Shell bypass of Mark of the Web. CISA's federal due date is 16 October.

Cybersecurity

Oct 14, 2026

CVE-2026-105445: Docker Hub PAT reassigned to another user

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-105445: Docker Hub PAT reassigned to another user

Docker Hub CVE-2026-105445 let an attacker reassign their own personal access token to another user during account conversion. Docker says it found no exploitation. Check whether you got the 2 October email.

Cybersecurity

Oct 14, 2026

Prev
1
2
3
4
5
Next