AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches

Ahsay Backup has issued fresh hotfixes for its AhsayCBS product after discovering that August 2026 patches for two vulnerabilities, CVE-2026-105133 and CVE-2026-105134, were incomplete. Attackers had been chaining these two bugs to bypass authentication and gain unauthenticated remote code execution, then planting web shells and XMRig cryptocurrency miners on exposed servers, as detailed in earlier reporting from Huntress. The vendor now says the real fix is delivered in AhsayCBS v10.3.4.45 and v9.15.2.70, and is urging customers to apply the hotfix and reboot their servers immediately; Huntress has confirmed the v10.3.4.45 build closes the initial entry point that remained open in prior v10 releases. Because the flaws are being actively exploited, CISA has added them to its Known Exploited Vulnerabilities catalog, giving federal agencies until October 17, 2026 to remediate.