AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
Summary: Ahsay Backup released new security updates for two AhsayCBS flaws, CVE-2026-105133 and CVE-2026-105134, after confirming that patches shipped in versions 9.15.2.59 and 10.3.4.0 in August 2026 did not completely close them. Huntress reported that threat actors chained the two flaws to achieve unauthenticated remote code execution and deploy web shells and XMRig cryptocurrency miners, and said it independently verified that the 10.3.4.45 hotfix mitigates the attack chain's initial entry point.
What's compelling: CISA added both flaws to the KEV catalog and requires federal agencies to patch by October 17, 2026 - and the first patch round did not hold, so any exposed AhsayCBS instance still running pre-hotfix versions remains a live target for web shell and miner deployment.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-105133CVE-2026-105134
- Related
- Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor Cyber Risks · Nov 10, 2026⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, Shiny Hunters Arrest, AI-Fooling Malware and More Cyber Risks ·CVE-2026-105133: Ahsay AhsayCBS Improper Authentication Vulnerability Known Exploited Vulnerabilities · Oct 14, 2026