Our blog | Matthews Enterprises

Our blog

tensorlake 0.5.144: npm worm steals cloud and AI-tool credentials

Matthews Enterprises (PTY) LTD, Francois Matthews

tensorlake 0.5.144: npm worm steals cloud and AI-tool credentials

tensorlake npm 0.5.144 shipped a ChainDrop credential worm on 8 October. The preinstall hook runs before any agent code reaches a sandbox.

Cybersecurity

Oct 8, 2026

FortiBleed: FBI says 86,644 FortiGate devices still locked out

Matthews Enterprises (PTY) LTD, Francois Matthews

FortiBleed: FBI says 86,644 FortiGate devices still locked out

The FBI and US Secret Service say FortiBleed attackers are still locking administrators out of exposed FortiGate firewalls and SSL VPN gateways.

Cybersecurity

Oct 8, 2026

tensorlake 0.5.144 npm worm steals cloud and AI-tool secrets

Matthews Enterprises (PTY) LTD, Francois Matthews

tensorlake 0.5.144 npm worm steals cloud and AI-tool secrets

tensorlake 0.5.144 on npm harvested developer, cloud, and AI-tool secrets and tried to republish itself. The version has been pulled.

Cybersecurity

Oct 8, 2026

PoeLLM mined more than 3,400 AI servers

Matthews Enterprises (PTY) LTD, Francois Matthews

PoeLLM mined more than 3,400 AI servers

Lumen's Black Lotus Labs says PoeLLM has pulled more than 3,400 servers into a cryptomining botnet since April, mostly by hitting exposed AI and document services.

Cybersecurity

Oct 8, 2026

LMCache CVE-2026-105192 unauthenticated RCE, no patch

Matthews Enterprises (PTY) LTD, Francois Matthews

LMCache CVE-2026-105192 unauthenticated RCE, no patch

JFrog says LMCache through 0.5.5 deserializes pickle on an unauthenticated ZeroMQ port. There is no fixed release. Official images run the process as root.

Cybersecurity

Oct 8, 2026

ccTLD hijack minted fake certificates for Google

Matthews Enterprises (PTY) LTD, Francois Matthews

ccTLD hijack minted fake certificates for Google

Attackers took over the .gh, .sl and .as registries in late September and obtained trusted HTTPS certificates for Google and other brands. Chrome has blocked the ones Google identified.

Cybersecurity

Oct 8, 2026

SonicWall SMA1000 CVE-2026-102255 is CVSS 10

Matthews Enterprises (PTY) LTD, Francois Matthews

SonicWall SMA1000 CVE-2026-102255 is CVSS 10

A CVSS 10 pre-auth SSRF in SMA 1000 Work Place lets an outsider reach internal functions. SonicWall has a hotfix and no confirmed exploitation yet.

Cybersecurity

Oct 8, 2026

ASOS confirms breach after app alert claimed Snowflake access

Matthews Enterprises (PTY) LTD, Francois Matthews

ASOS confirms breach after app alert claimed Snowflake access

ASOS confirmed unauthorized access after shoppers got an in-app message claiming the retailer's Snowflake instance was fully compromised. Payment cards were not believed impacted.

Cybersecurity

Oct 8, 2026

.gh .sl .as registry hijacks minted 12 Google certificates

Matthews Enterprises (PTY) LTD, Francois Matthews

.gh .sl .as registry hijacks minted 12 Google certificates

Google says attackers hijacked three country-code registries and obtained unauthorized HTTPS certificates for Google domains. Chrome blocked them. Domain owners under .gh, .sl and .as should check CT logs.

Cybersecurity

Oct 8, 2026

PoeLLM hits 3,400 servers mining on exposed LiteLLM and Ollama

Matthews Enterprises (PTY) LTD, Francois Matthews

PoeLLM hits 3,400 servers mining on exposed LiteLLM and Ollama

Lumen Black Lotus Labs says PoeLLM has hit more than 3,400 servers since April, turning exposed AI gateways into miners and scanners.

Cybersecurity

Oct 8, 2026

CVE-2026-102255 CVSS 10.0 SSRF in SonicWall SMA1000 WorkPlace

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-102255 CVSS 10.0 SSRF in SonicWall SMA1000 WorkPlace

SonicWall patched a CVSS 10.0 pre-auth SSRF in SMA1000 WorkPlace. No exploitation evidence yet, but the last two SSRF pairs in this portal were used in attacks.

Cybersecurity

Oct 8, 2026

Advantest confirms PII stolen in February ransomware attack

Matthews Enterprises (PTY) LTD, Francois Matthews

Advantest confirms PII stolen in February ransomware attack

Advantest's 6 October notice confirms the February ransomware attack stole SSNs, IDs, medical, and financial data. The victim count is still undisclosed.

Cybersecurity

Oct 7, 2026

Prev
7
8
9
10
11
Next