Our blog | Matthews Enterprises

12 Articles

Cybersecurity ×

AGENTS.md in Downloads: Codex ran planted npm malware in over 90% of tests

Matthews Enterprises (PTY) LTD, Francois Matthews

AGENTS.md in Downloads: Codex ran planted npm malware in over 90% of tests

A 13 KB AGENTS.md in a customer's Downloads folder told the coding agent to install a malicious npm package. Codex complied in over 90% of tests, and no vendor patch can stop it.

Cybersecurity

Oct 26, 2026

ConnectWise cloud backup: 2,250 Microsoft 365 tenants reached at 2,900 sign-ins per minute

Matthews Enterprises (PTY) LTD, Francois Matthews

ConnectWise cloud backup: 2,250 Microsoft 365 tenants reached at 2,900 sign-ins per minute

Stolen ConnectWise cloud backup credentials were used against more than 2,250 downstream Microsoft 365 tenants at 2,900 sign-ins a minute, with backdoor credentials added along the way.

Cybersecurity

Oct 26, 2026

Magento loader: 953 online stores hit, and deleting the script is not a fix

Matthews Enterprises (PTY) LTD, Francois Matthews

Magento loader: 953 online stores hit, and deleting the script is not a fix

A loader domain registered on 6 October appeared on 83 stores in days, 60 of which were already infected months earlier. Removing the script leaves the attacker's database access intact.

Cybersecurity

Oct 26, 2026

CVE-2026-110447: web shells planted on Nextcloud through Collabora's CODE app

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-110447: web shells planted on Nextcloud through Collabora's CODE app

An unauthenticated request could run a command whenever the bundled document server was down, and attackers used that window to drop PHP web shells on file servers.

Cybersecurity

Oct 26, 2026

PHP2Shell: CVE-2026-109618 RCE confirmed on a live PHP 8.4.26 server

Matthews Enterprises (PTY) LTD, Francois Matthews

PHP2Shell: CVE-2026-109618 RCE confirmed on a live PHP 8.4.26 server

Honeypot telemetry recorded working code execution against Apache mod_php on PHP 8.4.26. The flaw sits in the PHP engine, so no plugin, theme or framework update saves an unpatched server.

Cybersecurity

Oct 26, 2026

GitHub Actions: Gheist planted 13,500 credential-dumping workflows

Matthews Enterprises (PTY) LTD, Francois Matthews

GitHub Actions: Gheist planted 13,500 credential-dumping workflows

Wiz recovered 13,500 ci-sync branches created with 850 stolen GitHub tokens. Each one printed repository secrets into a log the attackers downloaded and then deleted.

Cybersecurity

Oct 26, 2026

.NET out-of-band update: CVE-2026-70197 and CVE-2026-102870 needed a second fix

Matthews Enterprises (PTY) LTD, Francois Matthews

.NET out-of-band update: CVE-2026-70197 and CVE-2026-102870 needed a second fix

Two fixes shipped on 13 October did not fully close the holes. Microsoft pushed corrected .NET 8, 9 and 10 builds on 25 October, and self-contained apps need a rebuild.

Cybersecurity

Oct 26, 2026

FNB fined R1 million under POPIA for exposing 88 home-loan applicants

Matthews Enterprises (PTY) LTD, Francois Matthews

FNB fined R1 million under POPIA for exposing 88 home-loan applicants

The Information Regulator fined FNB R1 million after a permissions error let 696 app users read the names, ID numbers and salary details of 88 home-loan applicants.

Cybersecurity

Oct 26, 2026

LiteSpeed Cache CVE-2026-113500: unauthenticated stored XSS, fixed in 7.9.2

Matthews Enterprises (PTY) LTD, Francois Matthews

LiteSpeed Cache CVE-2026-113500: unauthenticated stored XSS, fixed in 7.9.2

LiteSpeed Cache carries two unauthenticated stored XSS flaws, both rated 7.2, on a plugin with seven million active installs. The fix is in 7.9.2.

Cybersecurity

Oct 26, 2026

Windows Server 2016: the last security update lands in January 2027

Matthews Enterprises (PTY) LTD, Francois Matthews

Windows Server 2016: the last security update lands in January 2027

Microsoft has confirmed that the January 2027 security update is the last one Windows Server 2016 will get. Every edition is affected, and the replacement is Windows Server 2025.

Cybersecurity

Oct 26, 2026

Rand Mutual Assurance: Kazu gang claims 366GB of claim records

Matthews Enterprises (PTY) LTD, Francois Matthews

Rand Mutual Assurance: Kazu gang claims 366GB of claim records

Kazu says it holds 366GB of Rand Mutual Assurance claim records and has set a 4 November deadline. The insurer says only that it is investigating.

Cybersecurity

Oct 23, 2026

Microsoft 365 token replay: 497 sign-ins at 79 tenants, 48 rogue Entra devices

Matthews Enterprises (PTY) LTD, Francois Matthews

Microsoft 365 token replay: 497 sign-ins at 79 tenants, 48 rogue Entra devices

Huntress handled incidents at 79 organisations where attackers relayed the login, kept the post-MFA token and replayed it. Password resets alone left them inside.

Cybersecurity

Oct 23, 2026

Prev
9
10
11
12
13
Next