Threat actors are exploiting one critical and one medium-severity vulnerability still unpatched in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners. [...]

Threat actors are exploiting one critical and one medium-severity vulnerability still unpatched in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners.

TL;DR On October 7, security researchers detected active cyberattacks targeting the AhsayCBS backup platform. Threat actors chain two critical AhsayCBS vulnerabilities to achieve remote code execution on host servers. Administrators must immediately isolate exposed management consoles to prevent complete host compromise. Why It Matters AhsayCBS acts as the central management console for backup software across thousands of organizations worldwide. Managed service providers rely heavily on this software to control backup operations and enforce storage policies.

{{rh9e7yNRO}}

Threat actors are exploiting one critical and one medium-severity vulnerability still unpatched in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners.

What Researchers Discovered Security analysts monitoring threat feeds reported that attackers are actively exploiting two previously unpatched flaws in AhsayCBS, a popular backup and recovery platform. The vulnerabilities were publicly disclosed in early 2026, but many installations remain vulnerable, creating a fertile ground for malicious actors.

Threat actors are exploiting one critical and one medium-severity vulnerability still unpatched in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners.

Threat actors are exploiting one critical and one medium-severity vulnerability still unpatched in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners.

Two zero-day vulnerabilities in AhsayCBS are under active exploitation for unauthenticated remote code execution with SYSTEM privileges. Version 10.3.4, listed as the fix, has been verified as still vulnerable, leaving backup infrastructure exposed.

Haz clic para acceder al contenido completo.

The flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands.

L’article référencé ne fournit aucune donnée technique sur les vulnérabilités exploitées dans AhsayCBS, ni sur les mécanismes précis de déploiement du logiciel de minage XMRig. Aucun numéro de version

Huntressの研究者によると、攻撃者はAhsayのクラウドバックアップソフトウェアの管理コンソール「AhsayCBS」で新たに公開された2件の脆弱性を悪用し、サーバーを乗っ取って暗号資産マイナーをひそかに稼働させています。 AhsayCBS（Cloud Backup S

Attackers are exploiting two AhsayCBS flaws to gain remote code execution and deploy web shells and XMRig miners. Huntress says version 10.3.4 may also be…

Attackers exploited two AhsayCBS flaws to deploy JSP webshells and an XMRig miner at five or more organizations. Huntress says the latest version, 10.3.4, is…