Our blog | Matthews Enterprises

12 Articles

Cybersecurity ×

VMware ESXi CVE-2026-41709: 2.7 logging flaw exploited to hide vCenter intrusions

Matthews Enterprises (PTY) LTD, Francois Matthews

VMware ESXi CVE-2026-41709: 2.7 logging flaw exploited to hide vCenter intrusions

CISA listed a 2.7-rated ESXi logging flaw as exploited after CrowdStrike tied it to a China-nexus group hiding its tracks inside vCenter.

Cybersecurity

Oct 30, 2026

GCIS e-recruitment breach: applicant ID numbers and contact details exposed

Matthews Enterprises (PTY) LTD, Francois Matthews

GCIS e-recruitment breach: applicant ID numbers and contact details exposed

GCIS has told job applicants that its e-recruitment system was compromised, with ID numbers, phone numbers and email addresses potentially exposed.

Cybersecurity

Oct 30, 2026

Drupal Commerce Core CVE-2026-118539: access bypass exploited on 42,000 store sites

Matthews Enterprises (PTY) LTD, Francois Matthews

Drupal Commerce Core CVE-2026-118539: access bypass exploited on 42,000 store sites

Drupal rates CVE-2026-118539 highly critical: no login is needed to reach protected commerce routes and entity fields, and the module's own team says attacks are already live.

Cybersecurity

Oct 30, 2026

GitLab CVE-2026-97229: CVSS 10.0 RCE now exploited, and the Ruby fix matters too

Matthews Enterprises (PTY) LTD, Francois Matthews

GitLab CVE-2026-97229: CVSS 10.0 RCE now exploited, and the Ruby fix matters too

CISA added GitLab's CVSS 10.0 CI/CD regex flaw to its exploited list after an attacker nearly broke into Alpine Linux's instance. Upgrading GitLab alone was not enough.

Cybersecurity

Oct 30, 2026

Linux kernel CVE-2026-98432: 9.8 remote root flaw with no Ubuntu or RHEL patch

Matthews Enterprises (PTY) LTD, Francois Matthews

Linux kernel CVE-2026-98432: 9.8 remote root flaw with no Ubuntu or RHEL patch

The Linux kernel CVE team rates a TCP use-after-free 9.8. Fixed kernels exist for Debian and Oracle Linux, but not yet for Ubuntu or RHEL.

Cybersecurity

Oct 30, 2026

FNB fined R1 million after one access-control slip exposed 88 home loan files to 696 clients

Matthews Enterprises (PTY) LTD, Francois Matthews

FNB fined R1 million after one access-control slip exposed 88 home loan files to 696 clients

South Africa's Information Regulator fined FNB R1 million after a misconfigured app exposed 88 home loan applications to 696 unauthorised users.

Cybersecurity

Oct 30, 2026

319 Chrome extensions with 13.4 million installs hijacked search traffic

Matthews Enterprises (PTY) LTD, Francois Matthews

319 Chrome extensions with 13.4 million installs hijacked search traffic

Socket found 319 unlisted Chrome extensions with 13.4 million installs rerouting searches to Bing and Yahoo through operator-controlled proxies.

Cybersecurity

Oct 30, 2026

Tailscale SSH Tailworm Flaws: Root Escalation Fixed in 1.104.4

Matthews Enterprises (PTY) LTD, Francois Matthews

Tailscale SSH Tailworm Flaws: Root Escalation Fixed in 1.104.4

Eleven Tailscale findings let an already-authorised device reach root-only sockets through SSH forwarding. Patched in v1.104.4 this week.

Cybersecurity

Oct 29, 2026

Telegram for Android Call RCE: Fixed in 12.10.4, No CVE Assigned

Matthews Enterprises (PTY) LTD, Francois Matthews

Telegram for Android Call RCE: Fixed in 12.10.4, No CVE Assigned

A researcher says answering a Telegram voice call on Android was enough to run code, from 2022 builds up to 12.10.3. Fixed in 12.10.4.

Cybersecurity

Oct 29, 2026

Synology DSM CVE-2024-10441: Ransomware Encrypts Unpatched NAS Boxes (CVSS 9.8)

Matthews Enterprises (PTY) LTD, Francois Matthews

Synology DSM CVE-2024-10441: Ransomware Encrypts Unpatched NAS Boxes (CVSS 9.8)

Synology says attackers are exploiting a 2024 DSM flaw to encrypt NAS data and demand ransom. If your DiskStation never took the December 2024 update, it is in scope.

Cybersecurity

Oct 29, 2026

WordPress 7.1.4 Patches 22 Flaws Including an Upgrade-Window RCE

Matthews Enterprises (PTY) LTD, Francois Matthews

WordPress 7.1.4 Patches 22 Flaws Including an Upgrade-Window RCE

WordPress 7.1.4 closes 22 vulnerabilities across 17 advisories, including a race condition in the core updater that ends in remote code execution with no login.

Cybersecurity

Oct 29, 2026

Ninja Forms CVE-2026-94504: XSS campaign leaves a hidden WordPress admin

Matthews Enterprises (PTY) LTD, Francois Matthews

Ninja Forms CVE-2026-94504: XSS campaign leaves a hidden WordPress admin

Two stored XSS flaws in widely installed WordPress plugins are being used to plant a fake plugin, a hidden administrator and a passwordless file manager.

Cybersecurity

Oct 29, 2026

Prev
6
7
8
9
10
Next