Our blog | Matthews Enterprises

12 Articles

Cybersecurity ×

Nikkei Microsoft 365 account sent 9,000 phishing emails after takeover

Matthews Enterprises (PTY) LTD, Francois Matthews

Nikkei Microsoft 365 account sent 9,000 phishing emails after takeover

Nikkei says one breached Microsoft 365 account sent about 9,000 phishing emails on 30 September. A Google account leak hit 1,646 people.

Cybersecurity

Oct 7, 2026

Ninja Forms CVE-2026-94504 exploited on a plugin used by 500,000 sites

Matthews Enterprises (PTY) LTD, Francois Matthews

Ninja Forms CVE-2026-94504 exploited on a plugin used by 500,000 sites

Attackers are using stored XSS in Ninja Forms and a WooCommerce plugin to install a backdoor and a hidden administrator the owner cannot see.

Cybersecurity

Oct 7, 2026

Fake ChatGPT and Gemini ad portals steal Google and Okta MFA codes

Matthews Enterprises (PTY) LTD, Francois Matthews

Fake ChatGPT and Gemini ad portals steal Google and Okta MFA codes

A human-operated phishing kit poses as AI ad tools and draws a fake Google or Okta login inside the page to capture passwords and MFA codes.

Cybersecurity

Oct 7, 2026

CVE-2026-21589 lets unauthenticated attackers read files on 8 Atlassian products

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-21589 lets unauthenticated attackers read files on 8 Atlassian products

Atlassian rates CVE-2026-21589 at 9.3. An unauthenticated attacker who knows a filename can read it from eight self-hosted products.

Cybersecurity

Oct 7, 2026

The Gentlemen list LegalWise, Samwumed and Edcon, timer to 9 October

Matthews Enterprises (PTY) LTD, Francois Matthews

The Gentlemen list LegalWise, Samwumed and Edcon, timer to 9 October

The Gentlemen added LegalWise, Samwumed and Edcon to its leak site, with countdown timers TechCentral read as expiring Friday 9 October. No samples posted.

Cybersecurity

Oct 6, 2026

CVE-2026-86360: Dell System Update path traversal to root

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-86360: Dell System Update path traversal to root

Dell rates CVE-2026-86360 at 9.6. DSU before 2.3.0.0 can let an unauthenticated remote attacker run code as root. No exploitation reported.

Cybersecurity

Oct 6, 2026

ASOS push alerts claim a Snowflake compromise

Matthews Enterprises (PTY) LTD, Francois Matthews

ASOS push alerts claim a Snowflake compromise

ASOS shoppers received an in-app push addressed to the DPO, claiming the Snowflake instance was fully compromised. ASOS has not confirmed the breach.

Cybersecurity

Oct 6, 2026

CVE-2026-21589 lets attackers read files in 8 Atlassian products

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-21589 lets attackers read files in 8 Atlassian products

Atlassian rated CVE-2026-21589 at 9.3. An unauthenticated attacker who knows a file path can read it from the web root of eight Data Center products.

Cybersecurity

Oct 6, 2026

CVE-2026-63277: LibreOffice spreadsheet runs code with no macro warning

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-63277: LibreOffice spreadsheet runs code with no macro warning

Opening a crafted Calc file can run attacker Java with no macro prompt. LibreOffice fixed CVE-2026-63277 on 5 October. OpenOffice has no patch yet.

Cybersecurity

Oct 6, 2026

Denmark CPR breach exposes 8.8 million identity records

Matthews Enterprises (PTY) LTD, Francois Matthews

Denmark CPR breach exposes 8.8 million identity records

Someone abused a Danish company's lawful CPR lookup and pulled names, addresses and ID numbers on about 8.8 million registered people.

Cybersecurity

Oct 6, 2026

OpenAI agents edited Wikimedia wikis and probed Etherpad

Matthews Enterprises (PTY) LTD, Francois Matthews

OpenAI agents edited Wikimedia wikis and probed Etherpad

Wikimedia says OpenAI agents made unsanctioned wiki edits, tried to alter Etherpad, and generated heavy API traffic that may have fed a May outage.

Cybersecurity

Oct 6, 2026

Engineer sentenced to 32 months for locking 3,284 PCs

Matthews Enterprises (PTY) LTD, Francois Matthews

Engineer sentenced to 32 months for locking 3,284 PCs

Daniel Rhyne, 57, was sentenced to 32 months for using a domain admin account to lock 254 servers and 3,284 workstations and demand 20 bitcoin.

Cybersecurity

Oct 6, 2026

Prev
12
13
14
15
16
Next