Our blog | Matthews Enterprises

Our blog

Telegram for Android Call RCE: Fixed in 12.10.4, No CVE Assigned

Matthews Enterprises (PTY) LTD, Francois Matthews

Telegram for Android Call RCE: Fixed in 12.10.4, No CVE Assigned

A researcher says answering a Telegram voice call on Android was enough to run code, from 2022 builds up to 12.10.3. Fixed in 12.10.4.

Cybersecurity

Oct 29, 2026

Synology DSM CVE-2024-10441: Ransomware Encrypts Unpatched NAS Boxes (CVSS 9.8)

Matthews Enterprises (PTY) LTD, Francois Matthews

Synology DSM CVE-2024-10441: Ransomware Encrypts Unpatched NAS Boxes (CVSS 9.8)

Synology says attackers are exploiting a 2024 DSM flaw to encrypt NAS data and demand ransom. If your DiskStation never took the December 2024 update, it is in scope.

Cybersecurity

Oct 29, 2026

WordPress 7.1.4 Patches 22 Flaws Including an Upgrade-Window RCE

Matthews Enterprises (PTY) LTD, Francois Matthews

WordPress 7.1.4 Patches 22 Flaws Including an Upgrade-Window RCE

WordPress 7.1.4 closes 22 vulnerabilities across 17 advisories, including a race condition in the core updater that ends in remote code execution with no login.

Cybersecurity

Oct 29, 2026

Ninja Forms CVE-2026-94504: XSS campaign leaves a hidden WordPress admin

Matthews Enterprises (PTY) LTD, Francois Matthews

Ninja Forms CVE-2026-94504: XSS campaign leaves a hidden WordPress admin

Two stored XSS flaws in widely installed WordPress plugins are being used to plant a fake plugin, a hidden administrator and a passwordless file manager.

Cybersecurity

Oct 29, 2026

Cisco ASA and FTD CVE-2026-76418: one unauthenticated request reboots the firewall

Matthews Enterprises (PTY) LTD, Francois Matthews

Cisco ASA and FTD CVE-2026-76418: one unauthenticated request reboots the firewall

A crafted request to the SSL VPN login page restarts Cisco ASA and FTD firewalls that use secondary authentication on a tunnel group. No workaround exists.

Cybersecurity

Oct 29, 2026

Entra ID drops SMS and voice MFA on 1 February 2027, passkeys become the default

Matthews Enterprises (PTY) LTD, Francois Matthews

Entra ID drops SMS and voice MFA on 1 February 2027, passkeys become the default

Microsoft has repeated its warning: SMS and voice authentication stop working for Entra ID workforce tenants on 1 February 2027, and passkeys are now the default prompt users see.

Cybersecurity

Oct 29, 2026

Magento and Adobe Commerce CVE-2026-48356: guest-cart upload flaw added to CISA KEV

Matthews Enterprises (PTY) LTD, Francois Matthews

Magento and Adobe Commerce CVE-2026-48356: guest-cart upload flaw added to CISA KEV

CISA added the Magento guest-cart upload flaw to its exploited list on 27 October. Sansec has tied the same loader to at least 953 compromised storefronts since July 2025.

Cybersecurity

Oct 29, 2026

Checkout Files Upload CVE-2026-103688: CVSS 10 unauthenticated upload

Matthews Enterprises (PTY) LTD, Francois Matthews

Checkout Files Upload CVE-2026-103688: CVSS 10 unauthenticated upload

Patchstack published an unauthenticated arbitrary file upload in a WooCommerce checkout plugin on 28 October and scored it 10. No login is needed and the fix is a single plugin version bump.

Cybersecurity

Oct 29, 2026

Fragnesia CVE-2026-46300: Linux kernel root bug added to CISA KEV

Matthews Enterprises (PTY) LTD, Francois Matthews

Fragnesia CVE-2026-46300: Linux kernel root bug added to CISA KEV

CISA added the Linux page cache flaw to its exploited list on 28 October after attackers used it as the root half of PHP2Shell. The corruption lives only in memory, so a reboot clears the evidence.

Cybersecurity

Oct 29, 2026

YOOtheme Pro 5.0.53 closes CVE-2026-102785, a CVSS 10.0 image-handler RCE

Matthews Enterprises (PTY) LTD, Francois Matthews

YOOtheme Pro 5.0.53 closes CVE-2026-102785, a CVSS 10.0 image-handler RCE

The page builder's public image handler trusted a signature it never bound to the output path. Any visitor could write a PNG/PHP polyglot into a public media folder.

Cybersecurity

Oct 28, 2026

TianoCore EDK2 CVE-2026-97631: CVSS 9.5 code execution before the OS boots

Matthews Enterprises (PTY) LTD, Francois Matthews

TianoCore EDK2 CVE-2026-97631: CVSS 9.5 code execution before the OS boots

A wrong bounds check in the EDK II PXE driver copies ICMP error messages into a fixed 504-byte field. The result runs before Secure Boot or the operating system.

Cybersecurity

Oct 28, 2026

Bricksforge 3.1.8.10 closes CVE-2026-85097, a CVSS 9.8 upload RCE under automated attack

Matthews Enterprises (PTY) LTD, Francois Matthews

Bricksforge 3.1.8.10 closes CVE-2026-85097, a CVSS 9.8 upload RCE under automated attack

Bricksforge patched an unauthenticated upload flaw that turns a form submission into a PHP shell. Automated exploitation attempts started within days of disclosure.

Cybersecurity

Oct 28, 2026

Prev
3
4
5
6
7
Next