Skip to content
securitytabs

LiveUpdated

AhsayCBS backup flaws exploited to plant web shells and cryptominers

Attackers are breaking into servers running Ahsay's backup software and installing hidden remote-access tools and cryptocurrency miners. Organizations using AhsayCBS should update to the latest version now and limit who can reach it.

Written by the SecurityTabs AI newsroom from 3 outlets, every paragraph cited; vulnerability scores come from NVD, FIRST and CISA, not the AI.

Business Action

What this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

If your backups are run through AhsayCBS, often via an IT provider or MSP, attackers are actively exploiting it, according to Huntress and CISA. [1][2]

What to do

  1. Ask your provider whether AhsayCBS is in use and whether it has been updated to version 10.3.4 or later. [1]
  2. Ask that access to the backup server be restricted, as Huntress advises. [1]

Mid-size company

A small IT or security team

What to know

Two flaws can be chained to bypass login and run commands, and both are in CISA's KEV catalogue with a due date that has passed. Earlier patches were reportedly incomplete. [3][2]

What to do

  1. Update AhsayCBS to 10.3.4 or the latest release from Ahsay. [1][3]
  2. Restrict network access to the AhsayCBS management interface. [1]
  3. Check the server for unexpected web shells and cryptominer processes such as XMRig. [1]

Large enterprise

A security operations team

What to know

Huntress observed web shell and XMRig deployment through these flaws, and Ahsay issued new fixes after earlier patches were incomplete, per The Hacker News. [1][3]

What to do

  1. Inventory AhsayCBS servers, including those operated by MSPs and subsidiaries, and update to 10.3.4 or later. [1]
  2. Hunt for web shells and XMRig on these hosts and review the Huntress analysis for indicators. [1]
  3. Restrict exposure of the service to the internet. [1]

Vulnerabilities

What happened

Huntress says threat actors are exploiting AhsayCBS flaws, including CVE-2026-105133 and CVE-2026-105134, to deploy web shells (hidden remote-control scripts) and the XMRig cryptocurrency miner. The Hacker News reports the two flaws can be chained to bypass authentication and run arbitrary commands on affected systems. [1][3]

The Hacker News says Singapore-based Ahsay Backup has released updates for both flaws, and its headline says the new fixes followed incomplete patches. Huntress advises updating to version 10.3.4 and restricting access. [3][1]

Severity and listing

CVE-2026-105133 is an improper authentication flaw rated CVSS 5.5, and CVE-2026-105134 is an operating system command injection flaw rated 9.3. CISA added both to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, on October 14, with a federal due date of October 17. Known ransomware use is listed as unknown. [2]

What is not yet known

The sources reviewed do not name the attackers or say how many organizations were compromised. [1][3]

Timeline

  1. The Hacker News reported Ahsay had released new fixes after incomplete patches. [3]

  2. CISA added both AhsayCBS flaws to its KEV catalogue. [2]

  3. · CISA KEV

    CISA added CVE-2026-105134 to its Known Exploited Vulnerabilities catalog.

  4. · CISA KEV

    CISA added CVE-2026-105133 to its Known Exploited Vulnerabilities catalog.

  5. Huntress reported exploitation of AhsayCBS flaws to drop web shells and a cryptominer. [1]

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Sources

  1. [1]Huntress Blog · Oct 8, 20:00 UTC
    Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominercontext
  2. [2]CISA Advisories · Oct 14, 12:00 UTC
    CISA Adds Four Known Exploited Vulnerabilities to Catalogcontext
  3. [3]The Hacker News · Oct 15, 06:43 UTC
    AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patchescontext