AhsayCBS vulnerabilities prompt new hotfixes after attacks
AhsayCBS vulnerabilities CVE-2026-105133 and CVE-2026-105134 have received replacement hotfixes after attackers exploited the flaws to install web shells and XMRig cryptocurrency miners. A web shell is a malicious file or program that gives an attacker remote control through a web server. XMRig is software that uses a compromised system's computing resources to generate cryptocurrency. Ahsay Backup, the Singapore-based developer of AhsayCBS, released the new updates after confirming that its earlier patches had not completely resolved the vulnerabilities.
The two flaws can be chained, meaning an attacker can combine them as successive steps in one intrusion. Together, they allow authentication to be bypassed and arbitrary commands to be run on an affected server. Authentication is the check that normally requires a user to prove who they are, while arbitrary command execution means an attacker can make the system perform operations of the attacker's choosing. Huntress reported earlier this month that threat actors had combined the vulnerabilities to obtain unauthenticated remote code execution, which is the ability to control a system over a network without first signing in.
Huntress said it observed attackers using that access to deploy web shells and cryptocurrency miners on exposed systems. The web shells could provide a continuing route into compromised servers, while the XMRig installations put those systems to work mining cryptocurrency. The report does not identify a named threat group. For organisations operating AhsayCBS, the important point is that exploitation was observed in practice rather than remaining a theoretical possibility.
AhsayCBS versions 9.15.2.59 and 10.3.4.0, released in August 2026, were initially believed to address the vulnerabilities. Ahsay Backup has since confirmed that those patches did not fully close the flaws. Systems running those versions therefore should not be treated as protected merely because the August updates were installed. Administrators need to check the exact installed build rather than relying only on the fact that a previous security update was applied.
The replacement fixes are AhsayCBS v10.3.4.45 hotfix and AhsayCBS v9.15.2.70 hotfix. A hotfix is a focused software update intended to correct a specific problem without waiting for a broader release. Ahsay Backup urged customers to act immediately because of the severity of the risk and the need to protect customer data. The company also instructed administrators to reboot the server after applying the appropriate hotfix, making the restart a required part of the update process rather than an optional follow-up step.
Huntress independently tested the AhsayCBS 10.3.4.45 hotfix and reported that it blocks the initial entry point used by the attack chain. According to Huntress, that entry point had remained susceptible in previous version 10 releases. Its stated verification applies specifically to the 10.3.4.45 hotfix and the initial route into the chain. The available information does not describe equivalent independent testing of the 9.15.2.70 hotfix.
Applying the update prevents the known initial access route, but updating alone does not determine whether a server was compromised before the fix was installed. Because Huntress observed web shells and mining software being deployed, operators of exposed AhsayCBS systems should treat patching and checking for an earlier intrusion as separate tasks. Website owners or businesses that do not administer the server themselves should ask their hosting or IT provider to confirm the installed version, complete the reboot and examine the system for unfamiliar files or mining software.
The active attacks led the U.S. Cybersecurity and Infrastructure Security Agency, known as CISA, to add both vulnerabilities to its Known Exploited Vulnerabilities catalog. This catalog, commonly shortened to KEV, lists security flaws that are known to have been used in real attacks. U.S. federal agencies are required to apply the fixes by October 17, 2026. That deadline applies to those agencies, but the underlying exploitation risk is also relevant to other organisations operating affected systems.
For hosting providers and businesses, a vulnerable backup management system deserves prompt attention because it can expose a remotely reachable administrative service and may contain customer data that the vendor has urged users to protect. Administrators should verify both the hotfix installation and the required restart, while any signs of a web shell or miner should be handled as evidence of a possible compromise rather than as an ordinary software fault.
Organisations that need outside help with this type of systems response can consider AEU-I, which provides security-first IT, infrastructure and consulting. The immediate priority for every AhsayCBS operator remains installing the correct replacement hotfix, rebooting the server and checking whether the system was accessed before it was patched.