Our blog | Matthews Enterprises

12 Articles

Cybersecurity ×

Chrome 156.0.8078.73 fixes four critical flaws reachable from a web page

Matthews Enterprises (PTY) LTD, Francois Matthews

Chrome 156.0.8078.73 fixes four critical flaws reachable from a web page

Four of the 52 fixes in Chrome 156.0.8078.73 are rated Critical, including one that reaches code execution outside the sandbox. No exploitation reported yet.

Cybersecurity

Oct 28, 2026

Brotli CVE-2026-111497: .NET, PowerShell and PAN-OS ship fixes for the decoder overflow

Matthews Enterprises (PTY) LTD, Francois Matthews

Brotli CVE-2026-111497: .NET, PowerShell and PAN-OS ship fixes for the decoder overflow

Microsoft fixed .NET, Visual Studio and PowerShell on 25 October, and Palo Alto added PAN-OS on 26 October. The decoder ships inside dozens of products that bundle their own copy.

Cybersecurity

Oct 27, 2026

PHP2Shell CVE-2026-109618 and CVE-2026-109619 added to CISA KEV after confirmed RCE

Matthews Enterprises (PTY) LTD, Francois Matthews

PHP2Shell CVE-2026-109618 and CVE-2026-109619 added to CISA KEV after confirmed RCE

CISA added both PHP2Shell flaws to its exploited-vulnerability catalog after a honeypot recorded working code execution. PHP 8.2, 8.3, 8.4 and 8.5 all need patching.

Cybersecurity

Oct 27, 2026

Microsoft Authenticator CVE-2026-80097: any Android app could pull your work tokens

Matthews Enterprises (PTY) LTD, Francois Matthews

Microsoft Authenticator CVE-2026-80097: any Android app could pull your work tokens

An app with no permissions could impersonate Teams and ask Authenticator for delegated tokens, reaching mail, files and calendar. Microsoft rates it 8.6 and fixed it in 6.2606.4246.

Cybersecurity

Oct 27, 2026

Fake IT support on Teams: 400+ incidents, payload running in under 15 minutes

Matthews Enterprises (PTY) LTD, Francois Matthews

Fake IT support on Teams: 400+ incidents, payload running in under 15 minutes

Over 400 incidents share the same script: mail bombing, a Teams chat from "IT Support (Internal)", Quick Assist, then a backdoor and ransomware. No vulnerability is involved.

Cybersecurity

Oct 27, 2026

Rand Mutual investigates claimed 366GB claims data theft, 5 November leak deadline

Matthews Enterprises (PTY) LTD, Francois Matthews

Rand Mutual investigates claimed 366GB claims data theft, 5 November leak deadline

A threat actor claims 366GB of claims records and 593,786 files from Rand Mutual Assurance, and wants $95,000 before 5 November. The insurer says the investigation is still running.

Cybersecurity

Oct 27, 2026

ACF Extended 0.9.2.8 fixes CVSS 9.0 unauthenticated RCE and admin takeover

Matthews Enterprises (PTY) LTD, Francois Matthews

ACF Extended 0.9.2.8 fixes CVSS 9.0 unauthenticated RCE and admin takeover

Advanced Custom Fields: Extended below 0.9.2.8 carries an unauthenticated remote code execution flaw scored 9.0 and two account takeover paths. Sites using its front-end forms are exposed.

Cybersecurity

Oct 27, 2026

Apple backports CVE-2026-86950 zero-day to iPhone XS, XR and older iPads

Matthews Enterprises (PTY) LTD, Francois Matthews

Apple backports CVE-2026-86950 zero-day to iPhone XS, XR and older iPads

Apple has extended its September CoreGraphics zero-day fix to iPhone XS, XR and older iPads. Devices that cannot reach iOS 27 were left exposed until this week.

Cybersecurity

Oct 27, 2026

Dahua IP cameras hijacked via Easy4IP P2P and CVE-2021-33044 bypass

Matthews Enterprises (PTY) LTD, Francois Matthews

Dahua IP cameras hijacked via Easy4IP P2P and CVE-2021-33044 bypass

CERT-UA says attackers are hijacking Dahua cameras and recorders through the Easy4IP P2P cloud, using guessable serial numbers and a 2021 login bypass that still works on old firmware.

Cybersecurity

Oct 27, 2026

Information Regulator fines Johannesburg TVET college R500,000 under POPIA

Matthews Enterprises (PTY) LTD, Francois Matthews

Information Regulator fines Johannesburg TVET college R500,000 under POPIA

A Johannesburg TVET college was fined R500,000 for ignoring a POPIA enforcement notice. The failures it was punished for are common: no registered Information Officer, no framework, no breach report.

Cybersecurity

Oct 27, 2026

Tailworm: 11 unpatched Tailscale flaws, Tailscale SSH gives root

Matthews Enterprises (PTY) LTD, Francois Matthews

Tailworm: 11 unpatched Tailscale flaws, Tailscale SSH gives root

A researcher published 11 Tailscale findings without a coordinated fix. One lets any permitted Tailscale SSH user reach root on the target server, using forwarding that runs as root.

Cybersecurity

Oct 27, 2026

DreamHost forced email and FTP password resets after 23 October incident

Matthews Enterprises (PTY) LTD, Francois Matthews

DreamHost forced email and FTP password resets after 23 October incident

DreamHost reset email and FTP/SFTP passwords for affected accounts after File Manager problems on 23 October spread to other services. It still has not said what happened.

Cybersecurity

Oct 27, 2026

Prev
8
9
10
11
12
Next