Our blog | Matthews Enterprises

12 Articles

Cybersecurity ×

ScreenConnect abuse: rogue clients pushed to 286 MSP-managed endpoints

Matthews Enterprises (PTY) LTD, Francois Matthews

ScreenConnect abuse: rogue clients pushed to 286 MSP-managed endpoints

Six managed service providers and 286 endpoints across 47 organisations were caught in an active ScreenConnect campaign that installs attacker-controlled remote access clients.

Cybersecurity

Nov 12, 2026

Barracuda ESG CVE-2026-116606: CVSS 9.3 bypass chained to root, exploited

Matthews Enterprises (PTY) LTD, Francois Matthews

Barracuda ESG CVE-2026-116606: CVSS 9.3 bypass chained to root, exploited

Two flaws in Barracuda's email gateway chain into root: an authentication bypass that restores a crafted backup, then command injection. Exploitation confirmed.

Cybersecurity

Nov 11, 2026

OpenSSH CVE-2026-123158: CVSS 8.1 password bypass, exploited within 40 hours

Matthews Enterprises (PTY) LTD, Francois Matthews

OpenSSH CVE-2026-123158: CVSS 8.1 password bypass, exploited within 40 hours

An oversized password matches the asterisk placeholder on locked accounts in musl builds of sshd. Exploited within 40 hours of the fix, and now on CISA's KEV list.

Cybersecurity

Nov 11, 2026

Basel Post Types CVE-2026-89324: CVSS 9.8 login bypass to admin

Matthews Enterprises (PTY) LTD, Francois Matthews

Basel Post Types CVE-2026-89324: CVSS 9.8 login bypass to admin

A hardcoded fallback salt in Basel Post Types lets an unauthenticated attacker forge a social-login callback and take over an administrator account. Fixed in 1.19.

Cybersecurity

Nov 11, 2026

Contact Form 7 CVE-2026-114432: CVSS 9.8 file upload reaches code execution

Matthews Enterprises (PTY) LTD, Francois Matthews

Contact Form 7 CVE-2026-114432: CVSS 9.8 file upload reaches code execution

Any visitor can upload a file through a Contact Form 7 file field on versions 6.2 to 6.2.3, and on common Apache hosting that file runs as PHP. Fixed in 6.2.4.

Cybersecurity

Nov 11, 2026

Xen Orchestra VSA-2026-062: one empty cookie logs you in as admin, then root on XCP-ng

Matthews Enterprises (PTY) LTD, Francois Matthews

Xen Orchestra VSA-2026-062: one empty cookie logs you in as admin, then root on XCP-ng

A crafted cookie with an empty JSON object authenticates as the token owner with admin rights, and Vates confirms the flaw is being exploited to take root on XCP-ng hosts.

Cybersecurity

Nov 11, 2026

FortiManager CVE-2026-126170: unauthenticated command execution through the JRPC API

Matthews Enterprises (PTY) LTD, Francois Matthews

FortiManager CVE-2026-126170: unauthenticated command execution through the JRPC API

Fortinet's 10 November advisory covers a JSON injection flaw that lets an unauthenticated attacker run commands on FortiManager and FortiAnalyzer. 7.6.8 fixes it; 8.0 users need a workaround.

Cybersecurity

Nov 11, 2026

Ninja Forms File Uploads CVE-2026-126537: unauthenticated file deletion, CVSS 9.1

Matthews Enterprises (PTY) LTD, Francois Matthews

Ninja Forms File Uploads CVE-2026-126537: unauthenticated file deletion, CVSS 9.1

A 9.1-rated flaw in the Ninja Forms file upload add-on lets anonymous visitors delete files on the server, including wp-config.php. Version 3.3.37 fixes it.

Cybersecurity

Nov 11, 2026

Windows Search CVE-2026-116928: CVSS 9.8 RCE with no credentials and no clicks

Matthews Enterprises (PTY) LTD, Francois Matthews

Windows Search CVE-2026-116928: CVSS 9.8 RCE with no credentials and no clicks

A CVSS 9.8 out-of-bounds write in Windows Search needs no credentials and no user interaction. The November 2026 updates fix it on Windows 10, 11 and Server.

Cybersecurity

Nov 11, 2026

FortiOS OSPF bypass: unauthenticated route injection, fixed in 7.4.13

Matthews Enterprises (PTY) LTD, Francois Matthews

FortiOS OSPF bypass: unauthenticated route injection, fixed in 7.4.13

Where OSPF is enabled, a crafted request makes FortiOS broadcast false routing updates with no login at all. Fortinet shipped fixes on 10 November.

Cybersecurity

Nov 11, 2026

Microsoft Outlook CVE-2026-124194: opening a message file hands over your NTLMv2 hash

Matthews Enterprises (PTY) LTD, Francois Matthews

Microsoft Outlook CVE-2026-124194: opening a message file hands over your NTLMv2 hash

Opening one crafted message file makes Outlook connect out silently and hand over the user's NTLMv2 hash. Microsoft says the flaw is already exploited.

Cybersecurity

Nov 11, 2026

WPML CVE-2026-76877: CVSS 8.1 login bypass mints admin cookies

Matthews Enterprises (PTY) LTD, Francois Matthews

WPML CVE-2026-76877: CVSS 8.1 login bypass mints admin cookies

A race in WPML's cross-domain sign-on hands an unauthenticated attacker the session of any user mid-logout, administrators included. A million WordPress sites run the plugin.

Cybersecurity

Nov 10, 2026

Prev
1
2
3
4
5
Next