Unknown
Ahsay Backup has released security updates addressing CVE-2026-105133 and CVE-2026-105134 in AhsayCBS. The vulnerabilities, exploited in the wild prior to patching, allowed unauthenticated remote command execution and were chained to deploy web shells and XMRig cryptocurrency miners. Users are urged to apply the updates immediately.
Threat actors are exploiting two unpatched vulnerabilities in the AhsayCBS backup management platform. One vulnerability is rated critical severity and another medium severity. The exploitation has been observed in the wild and is being used to deploy webshells for persistent access and cryptocurrency miners for monetization. No patches are currently available, and the vulnerabilities remain unpatched. Affected organizations using AhsayCBS for backup management are at risk of persistent compromise and resource misuse.
Two third-party GitHub Actions previously compromised in a Mini Shai-Hulud campaign were re-enabled by their maintainer and remained accessible for more than a week despite still pointing to malicious code. Users who re-added these actions to their workflows were exposed to execution of malicious code, including potential cryptocurrency mining malware and credential theft, compromising CI/CD security and potentially exposing source code and artifacts.
The Netherlands National Cyber Security Centre (NCSC-NL) has issued an advisory warning that a critical authentication flaw in Apple macOS Screen Sharing (CVE-2026-65400, CVSS 9.8) is being actively exploited in the wild. Attackers are leveraging the vulnerability to gain unauthorized access to internet-exposed macOS systems and deploy a Monero cryptocurrency miner. Apple has released security updates to address the vulnerability, and users are strongly advised to apply the latest macOS updates immediately.