AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches

First reported by The Hacker News at 2:43 AM ET · Updated 2:43 AM · 1 source

Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners. The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems.

Reported so far by one publisher.

Summary from The Hacker News.

Reporting1

The Hacker News AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches · info@thehackernews.com (The Hacker News) 2:43 AM

Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto October 9

Ledger confirms tampered CryptoBilis wallets exposed recovery phrases October 12

GTA 6 leaker ties claimed playable build release to meme coin target October 11

Hackers use Plex2Shell to install miners and proxies on Plex servers October 18

Topics Crypto

AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches

Reporting1

Related