Our blog | Matthews Enterprises

Our blog

Five Flax Typhoon Flaws, CISA Deadline 11 October

Matthews Enterprises (PTY) LTD, Francois Matthews

Five Flax Typhoon Flaws, CISA Deadline 11 October

CISA added five flaws to the KEV catalog on 8 October after Flax Typhoon abuse, with a federal fix-or-retire date of 11 October 2026. Several bugs are a decade old.

Cybersecurity

Oct 9, 2026

CVE-2026-102255 SonicWall SMA1000 SSRF Under Probe

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-102255 SonicWall SMA1000 SSRF Under Probe

Previdian honeypots saw probes against the SMA1000 WorkPlace Extraweb path three days after SonicWall patched a CVSS 10.0 SSRF. Confirm builds on 6210, 7210 and 8200v.

Cybersecurity

Oct 9, 2026

Cisco NX-OS CVE-2026-76471: root on Nexus, CVSS 9.8

Matthews Enterprises (PTY) LTD, Francois Matthews

Cisco NX-OS CVE-2026-76471: root on Nexus, CVSS 9.8

Cisco patched five CVSS 9.8 NX-OS flaws that can run code as root on Nexus 3000 and 9000 switches. Exposure depends on NX-API, NGOAM, or MPLS OAM being enabled.

Cybersecurity

Oct 9, 2026

CVE-2026-106126: Tenable Identity Exposure SYSTEM injection, CVSS 9.9

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-106126: Tenable Identity Exposure SYSTEM injection, CVSS 9.9

A command injection in Tenable Identity Exposure can turn a low-privilege account into SYSTEM on the primary domain controller emulator. The upgrade alone is not the fix.

Cybersecurity

Oct 9, 2026

Midnight Mimosa: preinstalled Android malware in 150 countries

Matthews Enterprises (PTY) LTD, Francois Matthews

Midnight Mimosa: preinstalled Android malware in 150 countries

Bitdefender found Midnight Mimosa preinstalled in cheap Android firmware across 150-plus countries. The system app cannot be removed by a normal uninstall.

Cybersecurity

Oct 9, 2026

AhsayCBS CVE-2026-105134: SYSTEM RCE, 5 organizations hit

Matthews Enterprises (PTY) LTD, Francois Matthews

AhsayCBS CVE-2026-105134: SYSTEM RCE, 5 organizations hit

Huntress says attackers are chaining two unpatched AhsayCBS bugs for SYSTEM remote code execution, then dropping webshells and XMRig. Version 10.3.4 is still affected.

Cybersecurity

Oct 9, 2026

CVE-2026-21589: Atlassian Data Center file read at CVSS 9.3

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-21589: Atlassian Data Center file read at CVSS 9.3

Attackers probed Atlassian Data Center CVE-2026-21589 within hours of a public write-up. The CVSS 9.3 bug can expose Crowd credentials on self-hosted Jira.

Cybersecurity

Oct 9, 2026

CVE-2026-107406: NetScaler SAML RCE at CVSS 9.5

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-107406: NetScaler SAML RCE at CVSS 9.5

Citrix patched a CVSS 9.5 memory overflow in NetScaler ADC and Gateway when SAML is enabled. No confirmed exploit yet, but earlier NetScaler bugs were weaponized fast.

Cybersecurity

Oct 9, 2026

Cisco NX-OS CVE-2026-76471 and four more flaws score 9.8

Matthews Enterprises (PTY) LTD, Francois Matthews

Cisco NX-OS CVE-2026-76471 and four more flaws score 9.8

Cisco patched five CVSS 9.8 flaws in NX-OS that can give an unauthenticated attacker root on Nexus 3000 and 9000 switches if NGOAM, NX-API, or MPLS OAM is on.

Cybersecurity

Oct 9, 2026

Japan web data leaks hit 119 in 2026, 81 since July

Matthews Enterprises (PTY) LTD, Francois Matthews

Japan web data leaks hit 119 in 2026, 81 since July

JPCERT/CC warned on 8 October that Japanese organisations are leaking personal data through mobile-app APIs and Metabase CVE-2026-72898. Macnica counts 119 similar cases in 2026.

Cybersecurity

Oct 9, 2026

Citrix NetScaler CVE-2026-107406 scores 9.5 on SAML deployments

Matthews Enterprises (PTY) LTD, Francois Matthews

Citrix NetScaler CVE-2026-107406 scores 9.5 on SAML deployments

Citrix patched CVE-2026-107406, a CVSS 9.5 memory overflow in NetScaler ADC and Gateway when configured as a SAML IdP or SP. Prior patches do not cover it.

Cybersecurity

Oct 9, 2026

ARTEX AI pentest agent used in South Korean bank data theft

Matthews Enterprises (PTY) LTD, Francois Matthews

ARTEX AI pentest agent used in South Korean bank data theft

CrowdStrike says a Chinese-developed AI pentest agent, ARTEX, was used from late September to early October 2026 to steal data from South Korean financial firms.

Cybersecurity

Oct 9, 2026

Prev
5
6
7
8
9
Next