AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
Summary
Ahsay Backup has released updated security patches for two critical vulnerabilities (CVE-2026-105133 and CVE-2026-105134) in its AhsayCBS software. These flaws were exploited by attackers to deploy web shells and XMRig cryptocurrency miners, allowing for arbitrary command execution after bypassing authentication.
IFF Assessment
The exploitation of vulnerabilities to deploy web shells and cryptocurrency miners represents a direct threat to system integrity and resource availability for defenders.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: October 17, 2026. Known ransomware use: Unknown.
Defender Context
This highlights the ongoing risk posed by unpatched vulnerabilities in backup software, which attackers can leverage for deeper system compromise and resource abuse. Defenders should prioritize patching AhsayCBS and similar critical infrastructure software promptly, and monitor for indicators of compromise related to web shells and cryptocurrency mining.