12 OCT 2026 — Attackers are chaining two flaws in AhsayCBS, a backup management server used mainly by managed service providers, to plant webshells and a cryptocurrency miner. There is no working fix. The security firm Huntress, which reported the attacks, found that version 10.3.4, listed in the official vulnerability records as the version that resolves both flaws, is also vulnerable.
Huntress says it saw the first exploitation at 23:20 UTC on 7 October, and that five organisations had been targeted by the following day.
What Huntress saw
AhsayCBS is the management console for Ahsay's backup software. Administrators use it to create users, set backup policies and run replication, and it is usually reachable over the web. According to Huntress's write-up, the attackers sent commands through the AhsayCBS service process, ran reconnaissance, and dropped Java Server Page webshells into the directory the application serves.
On other hosts they downloaded a set of files from a cloud storage bucket, including the XMRig miner renamed as edge.exe. To keep it running, they created a Windows service called MicrosoftEdgeUpdateSvc, named to resemble the genuine Edge update service, which ran a modified copy of a legitimate service-management utility disguised as msedge.exe.
Two flaws, chained
The two bugs were published in the US National Vulnerability Database on 4 October. CVE-2026-105133 is an authentication flaw in the API. CVE-2026-105134 is an operating-system command injection in the replication receiver component. Both records say an exploit has been published. The second is rated critical: 9.3 on CVSS 4.0 and 10.0 on CVSS 3.1.
Huntress says the attackers used the first flaw to get past authentication and the second to run code as SYSTEM, the most privileged account on a Windows machine.
A miner that hides from Task Manager
One file, a PowerShell script named Taskgmr.ps1, watches for Windows Task Manager. When Task Manager opens, the script stops the mining service, and when Task Manager closes, it starts the service again. The script also closes Task Manager at 18:00 local time, and closes it if Task Manager has been left open for more than an hour overnight. Huntress says the script "appears to be an AI-assisted script", judging by its commented code.
In one incident the attackers also loaded WinRing0x64.sys, a legitimate but vulnerable driver. Such drivers are often used to switch off security tools, but here Huntress thinks it gave the miner kernel-level access to the hardware.
The fix that is not a fix
The vulnerability records both say the flaws affect AhsayCBS "up to 10.3.2" and that upgrading to 10.3.4 resolves them. Huntress notes earlier reporting had said 10.3.4 was not susceptible. In an update on the evening of 8 October, it said further investigation showed "Ahsay 10.3.4 is also affected by these vulnerabilities", and that it had shared its research with the vendor.
Anyone who upgraded on the strength of those records may therefore believe they are protected when they are not. BleepingComputer said it had asked Ahsay about its plans for a fix and had not received a reply.
What administrators should do
Until a patch is available, Huntress recommends restricting web access to the management interface to trusted IP addresses or a VPN. Where its indicators of compromise turn up, it advises re-imaging the host from a trusted backup rather than cleaning it, because the attackers may have left other backdoors. It has published four Sigma detection rules, one for each step the attackers rely on.
Backup consoles have been targets before. Last month a flaw in Acronis backup plugins for shared hosting was exploited. A compromised backup server is a particular problem for a service provider, because it holds the copies customers would rely on to recover from an attack.
View author profile → · Editorial policy
