Our blog | Matthews Enterprises

Our blog

CVE-2026-104935: Ivanti Connect Secure auth bypass exploited since Oct 3

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-104935: Ivanti Connect Secure auth bypass exploited since Oct 3

Ivanti Connect Secure CVE-2026-104935 is in CISA KEV. Attackers chained it for unauthenticated root on fully patched appliances. The privilege-escalation piece is still unfixed.

Cybersecurity

Oct 14, 2026

LG webOS local-network root chain, no PIN required

Matthews Enterprises (PTY) LTD, Francois Matthews

LG webOS local-network root chain, no PIN required

SSD disclosed a three-stage LG webOS chain that gives root on tested smart TVs from the same local network, with no PIN and no owner interaction. LG has issued a fix.

Cybersecurity

Oct 13, 2026

Ivanti Connect Secure CVE-2026-104935 zero-day, CVSS 8.6

Matthews Enterprises (PTY) LTD, Francois Matthews

Ivanti Connect Secure CVE-2026-104935 zero-day, CVSS 8.6

Ivanti says a limited number of Connect Secure customers are already hit by CVE-2026-104935, an authentication-bypass zero-day that runs commands with no login.

Cybersecurity

Oct 13, 2026

SAP Cloud SDK CVE-2026-89111 CVSS 10 OAuth2 SSRF

Matthews Enterprises (PTY) LTD, Francois Matthews

SAP Cloud SDK CVE-2026-89111 CVSS 10 OAuth2 SSRF

SAP's October patch day includes CVE-2026-89111, a CVSS 10 OAuth2 SSRF in the Cloud SDK for Python that can exfiltrate client credentials from multi-tenant BTP apps.

Cybersecurity

Oct 13, 2026

NetScaler CVE-2026-107406: CVSS 9.5 SAML memory overflow

Matthews Enterprises (PTY) LTD, Francois Matthews

NetScaler CVE-2026-107406: CVSS 9.5 SAML memory overflow

Citrix patched CVE-2026-107406, a CVSS 9.5 memory overflow in NetScaler SAML handling that can lead to remote code execution or a crash. No workaround.

Cybersecurity

Oct 13, 2026

Danfoss fridge controllers hijacked at 500 French stores

Matthews Enterprises (PTY) LTD, Francois Matthews

Danfoss fridge controllers hijacked at 500 French stores

Attackers remotely forced legacy Danfoss refrigeration controllers into continuous defrost at more than 500 French supermarkets, spoiling stock and reaching 50 C.

Cybersecurity

Oct 13, 2026

Ledger LTE implant stole recovery phrases via CryptoBilis

Matthews Enterprises (PTY) LTD, Francois Matthews

Ledger LTE implant stole recovery phrases via CryptoBilis

Ledger confirmed a covert LTE implant in signers sold by Southeast Asian reseller CryptoBilis. The chip read the 24-word recovery phrase off the screen.

Cybersecurity

Oct 13, 2026

GitLab CVE-2026-97229: CVSS 10 unauthenticated RCE

Matthews Enterprises (PTY) LTD, Francois Matthews

GitLab CVE-2026-97229: CVSS 10 unauthenticated RCE

A CVSS 10 integer overflow in GitLab's CI/CD regex compiler lets an unauthenticated attacker run code on self-managed CE and EE. Cloud is already patched.

Cybersecurity

Oct 13, 2026

Ledger finds implant in a CryptoBilis-sold wallet

Matthews Enterprises (PTY) LTD, Francois Matthews

Ledger finds implant in a CryptoBilis-sold wallet

Ledger confirmed an unauthorized hardware implant in at least one wallet sold by Southeast Asian reseller CryptoBilis, after users reported drained funds.

Cybersecurity

Oct 13, 2026

MarkLogic CVE-2026-85947 creates a hidden admin

Matthews Enterprises (PTY) LTD, Francois Matthews

MarkLogic CVE-2026-85947 creates a hidden admin

Progress fixed 31 MarkLogic flaws on 12 October. A forest-management user can create a hidden administrator account that survives after the original access is closed.

Cybersecurity

Oct 13, 2026

SonicWall CVE-2026-102255 SMA1000 SSRF probed

Matthews Enterprises (PTY) LTD, Francois Matthews

SonicWall CVE-2026-102255 SMA1000 SSRF probed

Researchers logged 135 attempts against a CVSS 10.0 pre-auth SSRF in SonicWall SMA1000 WorkPlace within days of the hotfix. SMA 100 Series is not affected.

Cybersecurity

Oct 13, 2026

Danfoss AK-SM controllers heated French fridges to 50C

Matthews Enterprises (PTY) LTD, Francois Matthews

Danfoss AK-SM controllers heated French fridges to 50C

Attackers took over Danfoss refrigeration controllers at hundreds of French supermarkets and forced defrost cycles up to 50C. CERT-FR says disconnect or filter them.

Cybersecurity

Oct 13, 2026

Prev
2
3
4
5
6
Next