Our blog | Matthews Enterprises

12 Articles

Cybersecurity ×

Refrigeration Controllers Under Active Attack, US Agencies Warn Cold Chain

Matthews Enterprises (PTY) LTD, Francois Matthews

Refrigeration Controllers Under Active Attack, US Agencies Warn Cold Chain

A joint US advisory confirms attackers are altering temperature and defrost settings on commercial refrigeration controllers, after waves of attacks on European supermarkets and blood storage.

Cybersecurity

Nov 9, 2026

Microsoft 365 Device-Code Phishing Hidden in Fake AI Event Invites

Matthews Enterprises (PTY) LTD, Francois Matthews

Microsoft 365 Device-Code Phishing Hidden in Fake AI Event Invites

Fake OpenAI, SpaceX and Anthropic event pages are harvesting Microsoft 365 and Google sessions. Device-code sign-in hands over tokens without a password, and the proxy stage steals the MFA response too.

Cybersecurity

Nov 9, 2026

Checkout Field Editor for WooCommerce Pro CVE-2026-122041: unauthenticated file deletion, CVSS 9.1

Matthews Enterprises (PTY) LTD, Francois Matthews

Checkout Field Editor for WooCommerce Pro CVE-2026-122041: unauthenticated file deletion, CVSS 9.1

A missing authorization check in the paid Checkout Field Editor for WooCommerce plugin lets unauthenticated requests delete any attachment in the media library. Fixed in 3.8.1.

Cybersecurity

Nov 9, 2026

Entra Device Registration CVE-2026-109469: a CVSS 10.0 bypass Microsoft fixed in its cloud

Matthews Enterprises (PTY) LTD, Francois Matthews

Entra Device Registration CVE-2026-109469: a CVSS 10.0 bypass Microsoft fixed in its cloud

Microsoft fixed a CVSS 10.0 authorization bypass in Entra Device Registration inside its own service, so no tenant patch exists. What is left is checking which devices your tenant trusts.

Cybersecurity

Nov 9, 2026

D-Link DGS-3130: unpatched DDP flaws in SMB switches, no firmware fix

Matthews Enterprises (PTY) LTD, Francois Matthews

D-Link DGS-3130: unpatched DDP flaws in SMB switches, no firmware fix

D-Link has no firmware for a set of flaws in its SMB managed switch line. The documented mitigation is to switch off the discovery protocol the bugs live in.

Cybersecurity

Nov 8, 2026

NightsBridge breach: 10,000-property SA booking platform hit by AI-driven attack

Matthews Enterprises (PTY) LTD, Francois Matthews

NightsBridge breach: 10,000-property SA booking platform hit by AI-driven attack

A South African platform sitting between 10,000 properties and the booking sites was breached on 2 November. The stolen fields are exactly what a convincing booking spoof needs.

Cybersecurity

Nov 8, 2026

D-Link DGS-3130-30TS: DDP flaws stay unpatched with no firmware release date

Matthews Enterprises (PTY) LTD, Francois Matthews

D-Link DGS-3130-30TS: DDP flaws stay unpatched with no firmware release date

D-Link published mitigations for unpatched flaws in the DGS-3130-30TS switch and said there is no corrective firmware yet. Disabling DDP is the interim control.

Cybersecurity

Nov 8, 2026

SonicWall CVE-2026-19868: SAML bypass skips MFA on SSL-VPN logins and is already exploited

Matthews Enterprises (PTY) LTD, Francois Matthews

SonicWall CVE-2026-19868: SAML bypass skips MFA on SSL-VPN logins and is already exploited

SonicWall investigated an attack abusing a SonicOS SSL-VPN flaw that lets a user with alternate credentials skip SAML and the MFA built on it. CISA added it to KEV the same day.

Cybersecurity

Nov 8, 2026

OpenSSH 10.6p2: musl servers accept a 257-byte password on key-only accounts

Matthews Enterprises (PTY) LTD, Francois Matthews

OpenSSH 10.6p2: musl servers accept a 257-byte password on key-only accounts

Alpine's sshd accepts a 257-byte password for any account with no password set, no guessing needed. Patch 10.6p2 or turn password logins off.

Cybersecurity

Nov 5, 2026

WatchGuard AuthPoint Gateway: CVSS 9.2 flaw lets attackers forge MFA results

Matthews Enterprises (PTY) LTD, Francois Matthews

WatchGuard AuthPoint Gateway: CVSS 9.2 flaw lets attackers forge MFA results

WatchGuard patched four AuthPoint Gateway flaws, including a 9.2 unauthenticated denial of service and an LDAP callback whose authentication result can be rewritten.

Cybersecurity

Nov 5, 2026

BookIt CVE-2026-62048: unauthenticated SQL injection at 9.3, patch 2.6.0.7

Matthews Enterprises (PTY) LTD, Francois Matthews

BookIt CVE-2026-62048: unauthenticated SQL injection at 9.3, patch 2.6.0.7

Patchstack rates the booking plugin flaw 9.3 with no login required, so the same database that holds WordPress accounts holds the customer bookings.

Cybersecurity

Nov 5, 2026

GhostMap: one Android APK, no permissions, an endless reboot loop

Matthews Enterprises (PTY) LTD, Francois Matthews

GhostMap: one Android APK, no permissions, an endless reboot loop

Bitdefender put a Pixel 10 into a 110-cycle boot loop with an APK that requests no permissions and never has to be opened. Google closed the report without a fix.

Cybersecurity

Nov 5, 2026

Prev
2
3
4
5
6
Next