Our blog | Matthews Enterprises

12 Articles

Cybersecurity ×

Cisco ASA and FTD CVE-2026-76418: one unauthenticated request reboots the firewall

Matthews Enterprises (PTY) LTD, Francois Matthews

Cisco ASA and FTD CVE-2026-76418: one unauthenticated request reboots the firewall

A crafted request to the SSL VPN login page restarts Cisco ASA and FTD firewalls that use secondary authentication on a tunnel group. No workaround exists.

Cybersecurity

Oct 29, 2026

Entra ID drops SMS and voice MFA on 1 February 2027, passkeys become the default

Matthews Enterprises (PTY) LTD, Francois Matthews

Entra ID drops SMS and voice MFA on 1 February 2027, passkeys become the default

Microsoft has repeated its warning: SMS and voice authentication stop working for Entra ID workforce tenants on 1 February 2027, and passkeys are now the default prompt users see.

Cybersecurity

Oct 29, 2026

Magento and Adobe Commerce CVE-2026-48356: guest-cart upload flaw added to CISA KEV

Matthews Enterprises (PTY) LTD, Francois Matthews

Magento and Adobe Commerce CVE-2026-48356: guest-cart upload flaw added to CISA KEV

CISA added the Magento guest-cart upload flaw to its exploited list on 27 October. Sansec has tied the same loader to at least 953 compromised storefronts since July 2025.

Cybersecurity

Oct 29, 2026

Checkout Files Upload CVE-2026-103688: CVSS 10 unauthenticated upload

Matthews Enterprises (PTY) LTD, Francois Matthews

Checkout Files Upload CVE-2026-103688: CVSS 10 unauthenticated upload

Patchstack published an unauthenticated arbitrary file upload in a WooCommerce checkout plugin on 28 October and scored it 10. No login is needed and the fix is a single plugin version bump.

Cybersecurity

Oct 29, 2026

Fragnesia CVE-2026-46300: Linux kernel root bug added to CISA KEV

Matthews Enterprises (PTY) LTD, Francois Matthews

Fragnesia CVE-2026-46300: Linux kernel root bug added to CISA KEV

CISA added the Linux page cache flaw to its exploited list on 28 October after attackers used it as the root half of PHP2Shell. The corruption lives only in memory, so a reboot clears the evidence.

Cybersecurity

Oct 29, 2026

YOOtheme Pro 5.0.53 closes CVE-2026-102785, a CVSS 10.0 image-handler RCE

Matthews Enterprises (PTY) LTD, Francois Matthews

YOOtheme Pro 5.0.53 closes CVE-2026-102785, a CVSS 10.0 image-handler RCE

The page builder's public image handler trusted a signature it never bound to the output path. Any visitor could write a PNG/PHP polyglot into a public media folder.

Cybersecurity

Oct 28, 2026

TianoCore EDK2 CVE-2026-97631: CVSS 9.5 code execution before the OS boots

Matthews Enterprises (PTY) LTD, Francois Matthews

TianoCore EDK2 CVE-2026-97631: CVSS 9.5 code execution before the OS boots

A wrong bounds check in the EDK II PXE driver copies ICMP error messages into a fixed 504-byte field. The result runs before Secure Boot or the operating system.

Cybersecurity

Oct 28, 2026

Bricksforge 3.1.8.10 closes CVE-2026-85097, a CVSS 9.8 upload RCE under automated attack

Matthews Enterprises (PTY) LTD, Francois Matthews

Bricksforge 3.1.8.10 closes CVE-2026-85097, a CVSS 9.8 upload RCE under automated attack

Bricksforge patched an unauthenticated upload flaw that turns a form submission into a PHP shell. Automated exploitation attempts started within days of disclosure.

Cybersecurity

Oct 28, 2026

TeamViewer 15.83 fixes CVE-2026-92372, a CVSS 8.8 decoder RCE

Matthews Enterprises (PTY) LTD, Francois Matthews

TeamViewer 15.83 fixes CVE-2026-92372, a CVSS 8.8 decoder RCE

Three TeamViewer client flaws fixed in 15.83: code execution from crafted screen data, a heap overflow, and root escalation on macOS.

Cybersecurity

Oct 28, 2026

WatchGuard Fireware 2026.4 fixes 18 Firebox flaws, seven at 9.1 or higher

Matthews Enterprises (PTY) LTD, Francois Matthews

WatchGuard Fireware 2026.4 fixes 18 Firebox flaws, seven at 9.1 or higher

WatchGuard published 18 Firebox advisories on 27 October, seven rated 9.1 or higher on CVSS 4.0. Three of them are reachable without a login.

Cybersecurity

Oct 28, 2026

Veeam Backup & Replication CVE-2026-108142: unauthenticated bypass, CVSS 9.1

Matthews Enterprises (PTY) LTD, Francois Matthews

Veeam Backup & Replication CVE-2026-108142: unauthenticated bypass, CVSS 9.1

An unauthenticated attacker can bypass authorization on Veeam's CDP Coordinator Service in Backup & Replication 13.1 and 13.0. Veeam fixed it on 27 October alongside a critical flaw in its Microsoft 365 backup product.

Cybersecurity

Oct 28, 2026

eMudhra root removal: Windows KB5134133 distrusts seven certificates

Matthews Enterprises (PTY) LTD, Francois Matthews

eMudhra root removal: Windows KB5134133 distrusts seven certificates

Eight intermediate keys generated in April 2025 had values below 256, so anyone could rebuild them and forge certificates. The fix targets PCs that miss automatic trust updates.

Cybersecurity

Oct 28, 2026

Prev
7
8
9
10
11
Next