Our blog | Matthews Enterprises

12 Articles

Cybersecurity ×

Windows 11 Always On VPN: the October update did not fix it

Matthews Enterprises (PTY) LTD, Francois Matthews

Windows 11 Always On VPN: the October update did not fix it

Microsoft marked the Always On VPN failure as fixed on 13 October, then returned it to Mitigated on 20 October. Affected fleets need the workaround for longer.

Cybersecurity

Oct 22, 2026

Duplicator CVE-2026-82814: CVSS 8.8 object injection on 1M+ sites

Matthews Enterprises (PTY) LTD, Francois Matthews

Duplicator CVE-2026-82814: CVSS 8.8 object injection on 1M+ sites

An anonymous comment can carry a PHP object that stays dormant until an administrator migrates the site. Duplicator 5.0.0 fixes it; old packages keep the old installer.

Cybersecurity

Oct 22, 2026

WP Mailster CVE-2026-111832: CVSS 10.0 web shell upload with no login

Matthews Enterprises (PTY) LTD, Francois Matthews

WP Mailster CVE-2026-111832: CVSS 10.0 web shell upload with no login

An unauthenticated upload path in WP Mailster let anyone drop a PHP web shell on a WordPress site. Fixed in 1.9.2.0; the patch does not remove what is already there.

Cybersecurity

Oct 22, 2026

Fortinet FortiOS 7.4.13 and 7.6.8 close critical flaws, advisories held to 10 November

Matthews Enterprises (PTY) LTD, Francois Matthews

Fortinet FortiOS 7.4.13 and 7.6.8 close critical flaws, advisories held to 10 November

Fortinet pushed critical FortiOS, FortiManager and FortiAnalyzer fixes on 22 October. Advisories and CVE numbers only arrive on 10 November, so this has to be scheduled on trust.

Cybersecurity

Oct 22, 2026

Chrome now warns when a ClickFix command lands on the clipboard

Matthews Enterprises (PTY) LTD, Francois Matthews

Chrome now warns when a ClickFix command lands on the clipboard

Chrome will now interrupt the moment a ClickFix page talks a user into pasting a PowerShell command. It only works where Enhanced Protection is switched on.

Cybersecurity

Oct 22, 2026

GitLab CVE-2026-110264: CVSS 10.0 unauthenticated RCE on self-managed servers

Matthews Enterprises (PTY) LTD, Francois Matthews

GitLab CVE-2026-110264: CVSS 10.0 unauthenticated RCE on self-managed servers

A max-severity integer overflow in GitLab's regex compiler lets an unauthenticated attacker run code on any self-managed instance back to version 7.0. Fixed builds are out.

Cybersecurity

Oct 22, 2026

Microsoft 365 device code phishing: Wazza kit steals Entra tokens without a password

Matthews Enterprises (PTY) LTD, Francois Matthews

Microsoft 365 device code phishing: Wazza kit steals Entra tokens without a password

PDF lures from hijacked mailboxes lead to a page that hands the victim a real Microsoft device code. Enter it and the attacker holds your tokens, MFA or not.

Cybersecurity

Oct 22, 2026

SafePay ransomware: 600+ victims, entered through VPN and edge-device flaws

Matthews Enterprises (PTY) LTD, Francois Matthews

SafePay ransomware: 600+ victims, entered through VPN and edge-device flaws

A joint CISA, FBI and international advisory puts SafePay at 600+ victims since 2024. Entry is usually a VPN or edge-device flaw; the exit is your backups, deleted.

Cybersecurity

Oct 21, 2026

eMudhra: eight weak CA keys could forge any HTTPS certificate

Matthews Enterprises (PTY) LTD, Francois Matthews

eMudhra: eight weak CA keys could forge any HTTPS certificate

Eight eMudhra intermediate CA keys were generated with so little randomness that one private key was the number 4. Browsers blocked them in hours; anything with its own trust store still has to be fixed.

Cybersecurity

Oct 21, 2026

Windows Secure Boot 2011 certificates expired on 19 October

Matthews Enterprises (PTY) LTD, Francois Matthews

Windows Secure Boot 2011 certificates expired on 19 October

The Secure Boot certificate that signs the Windows boot manager expired on 19 October. PCs and servers still holding the 2011 keys keep running, but lose future boot-level protections.

Cybersecurity

Oct 21, 2026

OVHcloud CLI 0.11.0 to 0.15.0 shipped a credential stealer

Matthews Enterprises (PTY) LTD, Francois Matthews

OVHcloud CLI 0.11.0 to 0.15.0 shipped a credential stealer

Someone used an OVHcloud developer's GitHub account to swap official CLI release binaries for a build that harvests secrets from disk. The window was about 94 minutes.

Cybersecurity

Oct 21, 2026

Chrome 156 fixes 353 flaws, six of them critical

Matthews Enterprises (PTY) LTD, Francois Matthews

Chrome 156 fixes 353 flaws, six of them critical

Chrome 156 landed on 20 October with 353 fixes, six of them critical memory-corruption bugs. Desktop builds older than 156.0.8078.47 carry the exposure.

Cybersecurity

Oct 21, 2026

Prev
1
2
3
4
5
Next