Our blog | Matthews Enterprises

12 Articles

Cybersecurity ×

Ampath breach: attacker claims 80 million records, lab disputes count

Matthews Enterprises (PTY) LTD, Francois Matthews

Ampath breach: attacker claims 80 million records, lab disputes count

Ampath confirmed a 2 October cyberattack and notified data subjects under POPIA. An attacker claims 80 million records. Ampath says that figure is database entries, not patients, and that clinical results are not.

Cybersecurity

Oct 14, 2026

Ivanti Connect Secure CVE-2026-104935 exploited, patch by 16 Oct

Matthews Enterprises (PTY) LTD, Francois Matthews

Ivanti Connect Secure CVE-2026-104935 exploited, patch by 16 Oct

CISA added an exploited Ivanti Connect Secure auth bypass to KEV. Unauthenticated attackers can run commands and steal credentials. Federal deadline is 16 October.

Cybersecurity

Oct 14, 2026

curl CVE-2026-92392 HTTP/2 upload flaw fixed in 8.23.0

Matthews Enterprises (PTY) LTD, Francois Matthews

curl CVE-2026-92392 HTTP/2 upload flaw fixed in 8.23.0

curl 8.23.0 fixes CVE-2026-92392, a High use-after-free on HTTP/2 uploads. A malicious server can corrupt client memory. A public proof of concept shows code execution under tight conditions.

Cybersecurity

Oct 14, 2026

CVE-2026-39919: Ghostscript PDF overflow can run code

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-39919: Ghostscript PDF overflow can run code

A crafted PDF can overflow Ghostscript's JPEG 2000 decoder and run code on servers that build thumbnails. Fixed in 10.08.0. No exploitation seen yet.

Cybersecurity

Oct 14, 2026

SAP October 2026: four critical flaws, one scored CVSS 10

Matthews Enterprises (PTY) LTD, Francois Matthews

SAP October 2026: four critical flaws, one scored CVSS 10

SAP shipped 22 notes on 13 October, four of them critical. One is an OAuth2 SSRF in Cloud SDK for Python scored 10. No exploitation reported.

Cybersecurity

Oct 14, 2026

CVE-2026-96951: Windows MotW bypass exploited, patch by 16 Oct

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-96951: Windows MotW bypass exploited, patch by 16 Oct

Microsoft patched an exploited Windows Shell flaw that skips Mark of the Web checks. CISA wants it fixed by 16 October.

Cybersecurity

Oct 14, 2026

CVE-2026-74580: Linux vhost flaw gives local users root

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-74580: Linux vhost flaw gives local users root

A nine-year-old Linux vhost bug, found with an AI research pipeline, gives local root and a guest-to-host write. No public exploitation yet.

Cybersecurity

Oct 14, 2026

Chrome 155 patches 37 flaws, 7 critical

Matthews Enterprises (PTY) LTD, Francois Matthews

Chrome 155 patches 37 flaws, 7 critical

Google shipped Chrome 155.0.8059.79 with fixes for 37 vulnerabilities, including 7 critical memory bugs. Anthropic reported 15 of them with Claude. Update now.

Cybersecurity

Oct 14, 2026

OpenAI employee arrested over hidden conference-room recorder

Matthews Enterprises (PTY) LTD, Francois Matthews

OpenAI employee arrested over hidden conference-room recorder

The FBI arrested a 35-year-old OpenAI engineer after the company found a hidden recording device in an executive conference-room television. OpenAI fired him and used its own models to trace the device.

Cybersecurity

Oct 14, 2026

CVE-2026-107656: FortiSandbox auth bypass, CVSS 9.6

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-107656: FortiSandbox auth bypass, CVSS 9.6

Fortinet disclosed CVE-2026-107656, a CVSS 9.6 authentication bypass in the FortiSandbox GUI. A remote attacker needs no login. Patch 5.0 and 4.4 now.

Cybersecurity

Oct 14, 2026

CVE-2026-39919: Ghostscript CVSS 9.8 PDF heap overflow

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-39919: Ghostscript CVSS 9.8 PDF heap overflow

Ghostscript CVE-2026-39919 is a CVSS 9.8 heap overflow in JPEG 2000 decoding. A crafted PDF can reach code execution on servers that build thumbnails, including WordPress. Fixed in 10.08.0.

Cybersecurity

Oct 14, 2026

npm SlugFest: 1,500+ packages exposed via Trusted Publishing

Matthews Enterprises (PTY) LTD, Francois Matthews

npm SlugFest: 1,500+ packages exposed via Trusted Publishing

Bloom Security says npm Trusted Publishing trusted GitHub repository names, not permanent IDs. More than 1,500 packages were exposed. GitHub's fix expires unvalidated configs after 48 hours.

Cybersecurity

Oct 14, 2026

Prev
4
5
6
7
8
Next