Our blog | Matthews Enterprises

12 Articles

Cybersecurity ×

Windows Paint CVE-2026-83844: 8.1 RCE and the fix that is not arriving

Matthews Enterprises (PTY) LTD, Francois Matthews

Windows Paint CVE-2026-83844: 8.1 RCE and the fix that is not arriving

A crafted image can run code through the Paint app built into Windows 11. Microsoft shipped a fix in October, but many PCs are still sitting on the vulnerable build.

Cybersecurity

Nov 5, 2026

Android CVE-2026-58868: zero-click RCE fixed in the November 2026 patch level

Matthews Enterprises (PTY) LTD, Francois Matthews

Android CVE-2026-58868: zero-click RCE fixed in the November 2026 patch level

Google's November bulletin closes a critical Framework RCE that needs no tap, no link and no permission prompt. Most phones will not have it for weeks.

Cybersecurity

Nov 5, 2026

ACF Extended PRO CVE-2026-120534: 9.8 unauthenticated RCE, and 0.9.2.7 is not the fix

Matthews Enterprises (PTY) LTD, Francois Matthews

ACF Extended PRO CVE-2026-120534: 9.8 unauthenticated RCE, and 0.9.2.7 is not the fix

A premium WordPress add-on injects code for anyone who can reach the site, no login needed. The version most guides call the fix still carries two more critical holes.

Cybersecurity

Nov 5, 2026

Apple CVE-2024-27834 joins CISA KEV: iOS below 17.5 is the gap

Matthews Enterprises (PTY) LTD, Francois Matthews

Apple CVE-2024-27834 joins CISA KEV: iOS below 17.5 is the gap

A two-year-old WebKit bug is now on the exploited list. Anything still below iOS 17.5 or macOS 14.5 is carrying a step that real exploit chains use.

Cybersecurity

Nov 5, 2026

CVE-2026-98432: Linux IPv4 TCP flaw puts RouterOS 7 and Ubuntu at risk

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-98432: Linux IPv4 TCP flaw puts RouterOS 7 and Ubuntu at risk

MikroTik has confirmed RouterOS 7 inherits a CVSS 9.8 use-after-free in the Linux IPv4 TCP stack. Routers with management services open to the internet are the exposed ones.

Cybersecurity

Nov 5, 2026

Chrome 157: 213 fixes, seven critical memory bugs in one update

Matthews Enterprises (PTY) LTD, Francois Matthews

Chrome 157: 213 fixes, seven critical memory bugs in one update

Google's Chrome 157 stable release closes 213 vulnerabilities, seven of them critical memory safety bugs in WebGPU and graphics code. No in-the-wild exploitation is known.

Cybersecurity

Nov 4, 2026

Google Calendar phishing steals live sessions and walks past MFA

Matthews Enterprises (PTY) LTD, Francois Matthews

Google Calendar phishing steals live sessions and walks past MFA

A campaign running since mid-August delivers phishing through Google Calendar invites and proxies the real sign-in page, capturing the session after MFA is approved.

Cybersecurity

Nov 4, 2026

Zyxel GS1900 CVE-2026-107441: 8.8 command execution that survived the June patch

Matthews Enterprises (PTY) LTD, Francois Matthews

Zyxel GS1900 CVE-2026-107441: 8.8 command execution that survived the June patch

Ten GS1900 models take an unauthenticated HTTP request that ends in OS commands. The June firmware everyone treated as the fix is still exploitable.

Cybersecurity

Nov 4, 2026

Xen XSA-523 CVE-2026-102703: one guest can read and write Dom0 memory

Matthews Enterprises (PTY) LTD, Francois Matthews

Xen XSA-523 CVE-2026-102703: one guest can read and write Dom0 memory

A malicious guest can read and write the memory of every other guest, including Dom0. Patches exist, there is no mitigation, and XCP-ng and XenServer hosts wait on their vendor.

Cybersecurity

Nov 4, 2026

mSecure: vendor tells every user to change stored passwords, reset 2FA and drop passkeys

Matthews Enterprises (PTY) LTD, Francois Matthews

mSecure: vendor tells every user to change stored passwords, reset 2FA and drop passkeys

mSeven Software detected suspicious activity in mSecure and told current and former users to rotate everything in the vault, while declining to say what was reached.

Cybersecurity

Nov 4, 2026

CVE-2025-43529 and CVE-2026-3910: zero-click iOS and Android exploits in an APT29 watering hole

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2025-43529 and CVE-2026-3910: zero-click iOS and Android exploits in an APT29 watering hole

A Russian group profiles visitors on compromised websites, then fires already-patched iOS and Chrome exploits with no click required to lift WhatsApp, Keychain and browser data.

Cybersecurity

Nov 4, 2026

SonicWall GMS CVE-2026-109593: 9.1 file read with no patch coming

Matthews Enterprises (PTY) LTD, Francois Matthews

SonicWall GMS CVE-2026-109593: 9.1 file read with no patch coming

SonicWall has published two GMS flaws and confirmed no fix is coming, because the product is end-of-life. The unauthenticated one scores 9.1.

Cybersecurity

Nov 4, 2026

Prev
3
4
5
6
7
Next