Ethical Hacking News
A critical vulnerability in AhsayCBS has been exploited by malicious actors to deploy web shells and cryptocurrency miners, putting the security of numerous systems at risk. Get the latest news and expert insights on how to address this threat and protect your organization's cybersecurity.
AhsayCBS, a Singapore-based backup solution, has been hit with two critical vulnerabilities (CVE-2026-105133 and CVE-2026-105134) that have been exploited by malicious actors. The vulnerabilities allow attackers to deploy web shells and XMRig cryptocurrency miners, putting systems at risk of data breaches and other malicious activities. The patches released by AhsayCBS in August 2026 did not completely fix the vulnerabilities, prompting the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add them to the Known Exploited Vulnerabilities (KEV) catalog. Organizations are advised to apply the patches by October 17, 2026, to prevent potential attacks and protect their systems. AhsayCBS has released security updates to address the vulnerabilities, and independent verification has confirmed the effectiveness of the hotfix in mitigating the initial entry point of the attack chain.
The cybersecurity landscape has been dealt a significant blow with the revelation of two critical vulnerabilities in AhsayCBS, a Singapore-based backup solution. The exploits, CVE-2026-105133 and CVE-2026-105134, have been used by malicious actors to deploy web shells and XMRig cryptocurrency miners, putting the security of numerous systems at risk. In this article, we will delve into the details of these vulnerabilities, their impact, and the measures being taken to address them.
AhsayCBS, a leading backup solution, had initially released patches to address the vulnerabilities in August 2026. However, it has now been confirmed that these patches did not completely plug the flaws, leaving systems exposed to further attacks. This has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add the vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the patches by October 17, 2026.
The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which can be chained to sidestep authentication and execute arbitrary commands on affected systems. This means that attackers can gain unauthorized access to systems, potentially leading to data breaches, ransomware attacks, and other malicious activities. The use of web shells and cryptocurrency miners by attackers is a clear indication of the severity of this threat.
In a report published earlier this month, Huntress observed threat actors combining the two flaws to achieve unauthenticated remote code execution and deploy web shells and cryptocurrency miners on exposed systems. This highlights the potential for attackers to use these vulnerabilities to launch sophisticated attacks, making it essential for organizations to take immediate action to secure their environments.
Ahsay has released security updates to address the vulnerabilities, which are available in the following versions: AhsayCBS v10.3.4.45 hotfix and AhsayCBS v9.15.2.70 hotfix. The company has urged users to take immediate action to secure their environments and protect their customer's data. After applying the hotfix, users are advised to reboot their server to ensure the patches are fully applied.
In an update, Huntress has independently verified that the AhsayCBS 10.3.4.45 hotfix mitigates the initial entry point of this attack chain, which was still susceptible on previous v10 versions. This confirms the effectiveness of the hotfix in addressing the vulnerabilities and highlights the importance of applying the patch as soon as possible.
The active exploitation of the flaws has prompted organizations to take notice and take action. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning to federal agencies to apply the patches by October 17, 2026, to prevent potential attacks. This demonstrates the global impact of this threat and the need for organizations to prioritize cybersecurity.
In conclusion, the AhsayCBS vulnerabilities represent a significant cybersecurity threat that requires immediate attention. The exploits have been used to deploy web shells and cryptocurrency miners, putting the security of numerous systems at risk. The measures being taken to address the vulnerabilities, including the release of hotfixes and the warning from CISA, highlight the importance of prioritizing cybersecurity and taking prompt action to secure systems.
A critical vulnerability in AhsayCBS has been exploited by malicious actors to deploy web shells and cryptocurrency miners, putting the security of numerous systems at risk. Get the latest news and expert insights on how to address this threat and protect your organization's cybersecurity.
Related Information:
https://www.ethicalhackingnews.com/articles/AhsayCBS-Flaws-A-Cybersecurity-Nightmare-that-Sparks-Global-Alert-ehn.shtml
https://thehackernews.com/2026/10/ahsaycbs-flaws-exploited-to-deploy-web.html
https://nvd.nist.gov/vuln/detail/CVE-2026-105133
https://www.cvedetails.com/cve/CVE-2026-105133/
https://nvd.nist.gov/vuln/detail/CVE-2026-105134
https://www.cvedetails.com/cve/CVE-2026-105134/
Published: Thu Oct 15 07:01:16 2026 by llama3.2 3B Q4_K_M
