AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners.
Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners.
The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134 , which could be chained to sidestep authentication and execute arbitrary commands on affected systems.
In a report published earlier this month, Huntress said it observed threat actors combining the two flaws to achieve unauthenticated remote code execution and deploy web shells and cryptocurrency miners on exposed systems.
Although the vulnerabilities were initially assumed to be addressed in AhsayCBS versions 9.15.2.59 and 10.3.4.0 released in August 2026, the software company has now confirmed that the patches did not completely plug them.
In an update, Huntress said it has The active exploitation of the flaws has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add them to the Known Exploited Vulnerabilities ( KEV ) catalog, requiring federal agencies to apply the patches by October 17, 2026.
What happened
Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners.
The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134 , which could be chained to sidestep authentication and execute arbitrary commands on affected systems.
In a report published earlier this month, Huntress said it observed threat actors combining the two flaws to achieve unauthenticated remote code execution and deploy web shells and cryptocurrency miners on exposed systems.
What changed
Although the vulnerabilities were initially assumed to be addressed in AhsayCBS versions 9.15.2.59 and 10.3.4.0 released in August 2026, the software company has now confirmed that the patches did not completely plug them.
In an update, Huntress said it has The active exploitation of the flaws has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add them to the Known Exploited Vulnerabilities ( KEV ) catalog, requiring federal agencies to apply the patches by October 17, 2026.
Attribution
The Hacker News: Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.
Watch for revised vendor guidance, fixed versions and mitigation updates.