Our blog | Matthews Enterprises

Our blog

Checkout Files Upload CVE-2026-103688: CVSS 10 unauthenticated upload

Matthews Enterprises (PTY) LTD, Francois Matthews

Checkout Files Upload CVE-2026-103688: CVSS 10 unauthenticated upload

Patchstack published an unauthenticated arbitrary file upload in a WooCommerce checkout plugin on 28 October and scored it 10. No login is needed and the fix is a single plugin version bump.

Cybersecurity

Oct 29, 2026

Fragnesia CVE-2026-46300: Linux kernel root bug added to CISA KEV

Matthews Enterprises (PTY) LTD, Francois Matthews

Fragnesia CVE-2026-46300: Linux kernel root bug added to CISA KEV

CISA added the Linux page cache flaw to its exploited list on 28 October after attackers used it as the root half of PHP2Shell. The corruption lives only in memory, so a reboot clears the evidence.

Cybersecurity

Oct 29, 2026

YOOtheme Pro 5.0.53 closes CVE-2026-102785, a CVSS 10.0 image-handler RCE

Matthews Enterprises (PTY) LTD, Francois Matthews

YOOtheme Pro 5.0.53 closes CVE-2026-102785, a CVSS 10.0 image-handler RCE

The page builder's public image handler trusted a signature it never bound to the output path. Any visitor could write a PNG/PHP polyglot into a public media folder.

Cybersecurity

Oct 28, 2026

TianoCore EDK2 CVE-2026-97631: CVSS 9.5 code execution before the OS boots

Matthews Enterprises (PTY) LTD, Francois Matthews

TianoCore EDK2 CVE-2026-97631: CVSS 9.5 code execution before the OS boots

A wrong bounds check in the EDK II PXE driver copies ICMP error messages into a fixed 504-byte field. The result runs before Secure Boot or the operating system.

Cybersecurity

Oct 28, 2026

Bricksforge 3.1.8.10 closes CVE-2026-85097, a CVSS 9.8 upload RCE under automated attack

Matthews Enterprises (PTY) LTD, Francois Matthews

Bricksforge 3.1.8.10 closes CVE-2026-85097, a CVSS 9.8 upload RCE under automated attack

Bricksforge patched an unauthenticated upload flaw that turns a form submission into a PHP shell. Automated exploitation attempts started within days of disclosure.

Cybersecurity

Oct 28, 2026

TeamViewer 15.83 fixes CVE-2026-92372, a CVSS 8.8 decoder RCE

Matthews Enterprises (PTY) LTD, Francois Matthews

TeamViewer 15.83 fixes CVE-2026-92372, a CVSS 8.8 decoder RCE

Three TeamViewer client flaws fixed in 15.83: code execution from crafted screen data, a heap overflow, and root escalation on macOS.

Cybersecurity

Oct 28, 2026

WatchGuard Fireware 2026.4 fixes 18 Firebox flaws, seven at 9.1 or higher

Matthews Enterprises (PTY) LTD, Francois Matthews

WatchGuard Fireware 2026.4 fixes 18 Firebox flaws, seven at 9.1 or higher

WatchGuard published 18 Firebox advisories on 27 October, seven rated 9.1 or higher on CVSS 4.0. Three of them are reachable without a login.

Cybersecurity

Oct 28, 2026

Veeam Backup & Replication CVE-2026-108142: unauthenticated bypass, CVSS 9.1

Matthews Enterprises (PTY) LTD, Francois Matthews

Veeam Backup & Replication CVE-2026-108142: unauthenticated bypass, CVSS 9.1

An unauthenticated attacker can bypass authorization on Veeam's CDP Coordinator Service in Backup & Replication 13.1 and 13.0. Veeam fixed it on 27 October alongside a critical flaw in its Microsoft 365 backup product.

Cybersecurity

Oct 28, 2026

eMudhra root removal: Windows KB5134133 distrusts seven certificates

Matthews Enterprises (PTY) LTD, Francois Matthews

eMudhra root removal: Windows KB5134133 distrusts seven certificates

Eight intermediate keys generated in April 2025 had values below 256, so anyone could rebuild them and forge certificates. The fix targets PCs that miss automatic trust updates.

Cybersecurity

Oct 28, 2026

Chrome 156.0.8078.73 fixes four critical flaws reachable from a web page

Matthews Enterprises (PTY) LTD, Francois Matthews

Chrome 156.0.8078.73 fixes four critical flaws reachable from a web page

Four of the 52 fixes in Chrome 156.0.8078.73 are rated Critical, including one that reaches code execution outside the sandbox. No exploitation reported yet.

Cybersecurity

Oct 28, 2026

Brotli CVE-2026-111497: .NET, PowerShell and PAN-OS ship fixes for the decoder overflow

Matthews Enterprises (PTY) LTD, Francois Matthews

Brotli CVE-2026-111497: .NET, PowerShell and PAN-OS ship fixes for the decoder overflow

Microsoft fixed .NET, Visual Studio and PowerShell on 25 October, and Palo Alto added PAN-OS on 26 October. The decoder ships inside dozens of products that bundle their own copy.

Cybersecurity

Oct 27, 2026

PHP2Shell CVE-2026-109618 and CVE-2026-109619 added to CISA KEV after confirmed RCE

Matthews Enterprises (PTY) LTD, Francois Matthews

PHP2Shell CVE-2026-109618 and CVE-2026-109619 added to CISA KEV after confirmed RCE

CISA added both PHP2Shell flaws to its exploited-vulnerability catalog after a honeypot recorded working code execution. PHP 8.2, 8.3, 8.4 and 8.5 all need patching.

Cybersecurity

Oct 27, 2026

Prev
1
2
3
4
5
Next