AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches
Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners. The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems. In a report published earlier
Security flaws in AhsayCBS, a Singapore-based backup solution, were recently exploited by malicious actors to install web shells and cryptocurrency mining software. The vulnerabilities, CVE-2026-105133 and CVE-2026-105134, allowed attackers to bypass authentication and execute arbitrary commands on affected systems. Although initial patches in versions 9.15.2.59 and 10.3.4.0 were thought to resolve the issues, Ahsay has now acknowledged that these fixes were incomplete.
The companies have since released updated versions, but users are strongly encouraged to apply the hotfixes as soon as possible and reboot their servers. Huntress, a cybersecurity firm, independently confirmed that the AhsayCBS 10.3.4.45 hotfix addresses the initial attack vector, which had previously remained vulnerable. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added these flaws to the Known Exploited Vulnerabilities (KEV) catalog, prompting federal agencies to apply the patches by October 17, 2026.
AI agents are now being used to access sensitive data and systems, highlighting the importance of implementing runtime identity controls to prevent breaches.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
