Our blog | Matthews Enterprises

12 Articles

Cybersecurity ×

Cling botnet hides operator commands inside STUN traffic

Matthews Enterprises (PTY) LTD, Francois Matthews

Cling botnet hides operator commands inside STUN traffic

Attackers are exploiting a 2021 Realtek flaw to drop Cling, a botnet that hides operator commands inside ordinary STUN traffic.

Cybersecurity

Oct 6, 2026

Exchange CVE-2026-96940: signed-in users can read other mailboxes

Matthews Enterprises (PTY) LTD, Francois Matthews

Exchange CVE-2026-96940: signed-in users can read other mailboxes

A signed-in Exchange user can read other mailboxes in the same organization. On-prem servers need the September 2026 V2 update. Online is already fixed.

Cybersecurity

Oct 6, 2026

Apple tightens macOS Full Disk Access after AI agent risk

Matthews Enterprises (PTY) LTD, Francois Matthews

Apple tightens macOS Full Disk Access after AI agent risk

Apple will require explicit consent before macOS apps get Full Disk Access, because AI agents can read mail, messages, and files.

Cybersecurity

Oct 5, 2026

CVE-2026-86360: Dell System Update flaw scores 9.6, root on PowerEdge

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-86360: Dell System Update flaw scores 9.6, root on PowerEdge

Dell System Update before 2.3.0.0 can give an unauthenticated remote attacker root on PowerEdge hosts. Upgrade DSU before the next window.

Cybersecurity

Oct 5, 2026

ShinyHunters: suspected member detained in Jordan

Matthews Enterprises (PTY) LTD, Francois Matthews

ShinyHunters: suspected member detained in Jordan

Jordan detained a suspected ShinyHunters member known as Rey. Sources told Reuters and CBS he is cooperating with the FBI after the group's FBI jobs-site claim.

Cybersecurity

Oct 5, 2026

macOS Full Disk Access: Apple tightens AI agent controls

Matthews Enterprises (PTY) LTD, Francois Matthews

macOS Full Disk Access: Apple tightens AI agent controls

Apple said on 2 October it will add controls so Full Disk Access can only be granted with a very explicit user action, because AI agents raise the risk.

Cybersecurity

Oct 5, 2026

Zammad CVE-2026-102489: KEV due date is today

Matthews Enterprises (PTY) LTD, Francois Matthews

Zammad CVE-2026-102489: KEV due date is today

CISA's remediation deadline for two chained Zammad flaws is 5 October. On version 6.5 and older, a session bug plus a local privilege bug can reach root.

Cybersecurity

Oct 5, 2026

CVE-2026-61500: Rejetto HFS admin session forgery

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-61500: Rejetto HFS admin session forgery

VulnCheck says attackers are already probing CVE-2026-61500, which lets a remote user forge a Rejetto HFS administrator cookie and run code.

Cybersecurity

Oct 5, 2026

Denmark CPR breach: 8.8 million identity records

Matthews Enterprises (PTY) LTD, Francois Matthews

Denmark CPR breach: 8.8 million identity records

Unauthorized parties misused a Danish company's lawful CPR access and reached names, addresses, and ID numbers for about 8.8 million registered people.

Cybersecurity

Oct 5, 2026

CVE-2026-102489: Zammad session flaw chained to root, due 5 October

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-102489: Zammad session flaw chained to root, due 5 October

CISA's remediation date for two exploited Zammad flaws is 5 October. Chained, they go from a helpdesk session to code execution as the zammad user, then to root.

Cybersecurity

Oct 5, 2026

CVE-2026-105215: ZITADEL Login V1 account pre-hijack, CVSS 9.1

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-105215: ZITADEL Login V1 account pre-hijack, CVSS 9.1

ZITADEL Login V1 trusted client-supplied external identity fields before the IdP callback finished. An attacker can pre-create the account a victim later signs into.

Cybersecurity

Oct 5, 2026

CVE-2026-61500: Rejetto HFS admin session forgery, CVSS 9.3

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-61500: Rejetto HFS admin session forgery, CVSS 9.3

Rejetto HTTP File Server 3.0.0 through 3.2.0 signs admin cookies with Math.random(). Attackers are already forging those sessions for remote code execution.

Cybersecurity

Oct 5, 2026

Prev
14
15
16
17
18
Next