AhsayCBS Vulnerabilities Patched After Wild Exploitation

Singapore-based Ahsay Backup has released security updates to address two critical security flaws in AhsayCBS that have been exploited by threat actors to deploy web shells and XMRig cryptocurrency miners. The vulnerabilities, identified as CVE-2026-105133 and CVE-2026-105134, could be chained to sidestep authentication and execute arbitrary commands on affected systems.

According to reports, the flaws were being actively exploited in the wild before the patches were released. Exploitation of the vulnerabilities allowed attackers to bypass authentication mechanisms and gain remote command execution capabilities. The attack chain was reportedly used to deploy web shells for persistent access and XMRig miners for cryptocurrency mining operations.

Ahsay Backup stated that the security updates address the identified vulnerabilities. The company has urged all AhsayCBS users to apply the updates immediately to protect their systems from potential exploitation. The incident highlights the continued risk posed by unpatched backup and management software, which often operates with elevated privileges and extensive system access.