Hackers chain two unpatched AhsayCBS flaws to plant webshells and cryptominers

AhsayCBS (Cloud Backup Server) is the central management console for Ahsay's backup software, used mainly by managed service providers and system integrators. Two flaws were disclosed on October 4: CVE-2026-105133, an improper authentication bug in a password-checking function, and CVE-2026-105134, a critical flaw in the Replication Receiver's API, where an authentication bypass lets a random token stand in for valid credentials and leads to unauthenticated code execution as NT AUTHORITY\SYSTEM.

Huntress observed attackers chaining the two from 23:20 UTC on October 7. In some incidents they configured a malicious receiver and dropped JSP webshells into the application directory; in others the AhsayCBS service spawned commands that downloaded files from a cloud storage bucket, including the XMRig Monero miner disguised as edge.exe, a modified copy of the NSSM service manager renamed msedge.exe and run as a fake Microsoft Edge Update service with SYSTEM privileges, and an apparently AI-assisted PowerShell script that closes Task Manager to hide the miner.

Huntress initially reported that version 10.3.4 was safe, but on October 8 confirmed that all AhsayCBS versions through 10.3.4 are affected, and there is no patch yet. It recommends limiting access to the management web interface to trusted IP addresses or a VPN, checking for its published indicators, and fully re-imaging any compromised host from a trusted backup, since attackers may have hidden secondary backdoors.