Our blog | Matthews Enterprises

Our blog

CVE-2026-110447: web shells planted on Nextcloud through Collabora's CODE app

Matthews Enterprises (PTY) LTD, Francois Matthews

CVE-2026-110447: web shells planted on Nextcloud through Collabora's CODE app

An unauthenticated request could run a command whenever the bundled document server was down, and attackers used that window to drop PHP web shells on file servers.

Cybersecurity

Oct 26, 2026

PHP2Shell: CVE-2026-109618 RCE confirmed on a live PHP 8.4.26 server

Matthews Enterprises (PTY) LTD, Francois Matthews

PHP2Shell: CVE-2026-109618 RCE confirmed on a live PHP 8.4.26 server

Honeypot telemetry recorded working code execution against Apache mod_php on PHP 8.4.26. The flaw sits in the PHP engine, so no plugin, theme or framework update saves an unpatched server.

Cybersecurity

Oct 26, 2026

GitHub Actions: Gheist planted 13,500 credential-dumping workflows

Matthews Enterprises (PTY) LTD, Francois Matthews

GitHub Actions: Gheist planted 13,500 credential-dumping workflows

Wiz recovered 13,500 ci-sync branches created with 850 stolen GitHub tokens. Each one printed repository secrets into a log the attackers downloaded and then deleted.

Cybersecurity

Oct 26, 2026

.NET out-of-band update: CVE-2026-70197 and CVE-2026-102870 needed a second fix

Matthews Enterprises (PTY) LTD, Francois Matthews

.NET out-of-band update: CVE-2026-70197 and CVE-2026-102870 needed a second fix

Two fixes shipped on 13 October did not fully close the holes. Microsoft pushed corrected .NET 8, 9 and 10 builds on 25 October, and self-contained apps need a rebuild.

Cybersecurity

Oct 26, 2026

FNB fined R1 million under POPIA for exposing 88 home-loan applicants

Matthews Enterprises (PTY) LTD, Francois Matthews

FNB fined R1 million under POPIA for exposing 88 home-loan applicants

The Information Regulator fined FNB R1 million after a permissions error let 696 app users read the names, ID numbers and salary details of 88 home-loan applicants.

Cybersecurity

Oct 26, 2026

LiteSpeed Cache CVE-2026-113500: unauthenticated stored XSS, fixed in 7.9.2

Matthews Enterprises (PTY) LTD, Francois Matthews

LiteSpeed Cache CVE-2026-113500: unauthenticated stored XSS, fixed in 7.9.2

LiteSpeed Cache carries two unauthenticated stored XSS flaws, both rated 7.2, on a plugin with seven million active installs. The fix is in 7.9.2.

Cybersecurity

Oct 26, 2026

Windows Server 2016: the last security update lands in January 2027

Matthews Enterprises (PTY) LTD, Francois Matthews

Windows Server 2016: the last security update lands in January 2027

Microsoft has confirmed that the January 2027 security update is the last one Windows Server 2016 will get. Every edition is affected, and the replacement is Windows Server 2025.

Cybersecurity

Oct 26, 2026

Rand Mutual Assurance: Kazu gang claims 366GB of claim records

Matthews Enterprises (PTY) LTD, Francois Matthews

Rand Mutual Assurance: Kazu gang claims 366GB of claim records

Kazu says it holds 366GB of Rand Mutual Assurance claim records and has set a 4 November deadline. The insurer says only that it is investigating.

Cybersecurity

Oct 23, 2026

Microsoft 365 token replay: 497 sign-ins at 79 tenants, 48 rogue Entra devices

Matthews Enterprises (PTY) LTD, Francois Matthews

Microsoft 365 token replay: 497 sign-ins at 79 tenants, 48 rogue Entra devices

Huntress handled incidents at 79 organisations where attackers relayed the login, kept the post-MFA token and replayed it. Password resets alone left them inside.

Cybersecurity

Oct 23, 2026

ArubaOS: eight CVSS 10.0 flaws among 72 patched, pre-auth on AOS-8 and AOS-10

Matthews Enterprises (PTY) LTD, Francois Matthews

ArubaOS: eight CVSS 10.0 flaws among 72 patched, pre-auth on AOS-8 and AOS-10

HPE shipped 72 ArubaOS fixes. Eight are pre-auth authentication bypass and code execution flaws on AOS-8 and AOS-10, reachable with no credentials and no user action.

Cybersecurity

Oct 23, 2026

Pillow CVE-2026-112900: EPS filename injection, CVSS 9.2, fixed in 13.0.0

Matthews Enterprises (PTY) LTD, Francois Matthews

Pillow CVE-2026-112900: EPS filename injection, CVSS 9.2, fixed in 13.0.0

Pillow handed an attacker-controlled EPS filename straight to Ghostscript. A leading @ turned that name into an argument file, and the fix only landed in 13.0.0.

Cybersecurity

Oct 23, 2026

Linux KSMBD ZDI-CAN-33774: pre-auth RCE on port 445, CVSS 9.0, no kernel fix

Matthews Enterprises (PTY) LTD, Francois Matthews

Linux KSMBD ZDI-CAN-33774: pre-auth RCE on port 445, CVSS 9.0, no kernel fix

ZDI published a CVSS 9.0 pre-authentication RCE in Linux's in-kernel SMB server before any patch existed. If ksmbd is loaded and 445 is reachable, that is the exposure.

Cybersecurity

Oct 23, 2026

Prev
1
2
3
4
5
Next