Attackers Exploit AhsayCBS Flaws to Deploy XMRig Miners Disguised as Microsoft Edge

Security researchers at Huntress report active exploitation of two AhsayCBS backup-software vulnerabilities, tracked as CVE-2026-105133 (an authentication bypass, CVSS 5.5) and CVE-2026-105134 (an OS command injection in the Replication Receiver component, CVSS 9.3). By combining both flaws, attackers can skip login checks and run arbitrary commands remotely. Huntress says intrusion attempts started on October 7, 2026, with at least five organizations hit by October 8, leading to reconnaissance, web shell deployment, and installation of XMRig cryptominers disguised under the filename edge.exe to mimic Microsoft Edge. The attackers also dropped an apparently AI-written PowerShell script that forces the mining process to pause whenever Task Manager is opened and kills Task Manager overnight if left running too long, and in one case used certutil.exe to fetch the vulnerable WinRing0x64.sys driver for kernel-level access. Although Ahsay's advisory claims the issues are fixed in version 10.3.4, Huntress found that release still exploitable, effectively making these zero-days; until a real patch ships, admins are urged to restrict access to the AhsayCBS management interface to trusted IPs or VPN connections.