Cybersecurity
Ahsay Backup releases new AhsayCBS hotfixes
Ahsay Backup issued new hotfixes for AhsayCBS after saying earlier August updates had not fully fixed two flaws that Huntress said were being chained for remote code execution and payload deployment.
- Ahsay Backup released AhsayCBS v10.3.4.45 and v9.15.2.70 hotfixes.
- The company said August 2026 releases had not fully fixed CVE-2026-105133 and CVE-2026-105134.
- Huntress said earlier this month that it had seen the flaws used together to gain unauthorised remote code execution and install web shells and XMRig miners.
- The U.S. Cybersecurity and Infrastructure Security Agency added the flaws to its Known Exploited Vulnerabilities catalogue and set 17 October 2026 as the patch deadline for federal agencies.
Ahsay Backup issued hotfixes for AhsayCBS v10.3.4.45 and v9.15.2.70. It said earlier August 2026 releases had not fully closed CVE-2026-105133 and CVE-2026-105134.
Huntress said earlier this month that threat actors had linked the two flaws to obtain unauthorised remote code execution. It said the activity was used to place web shells and XMRig miners on exposed systems.
Ahsay told customers to apply the hotfixes and reboot servers afterwards. In its update, it said the risks were serious and urged immediate action to protect customer data.
Huntress later said it had independently checked that the v10.3.4.45 hotfix blocked the initial entry point on earlier v10 builds. The U.S. Cybersecurity and Infrastructure Security Agency added the flaws to its Known Exploited Vulnerabilities catalogue and required federal agencies to patch by 17 October 2026.
Named in this story
Companies
- Ahsay Backup
- released the new hotfixes and said earlier patches were incomplete
- Huntress
- said it saw exploitation and later verified the hotfix
Governments and agencies
- U.S. Cybersecurity and Infrastructure Security Agency
- added the flaws to its exploitation catalogue and set a patch deadline
Products and systems
- AhsayCBS
- the backup software with the two exploitable flaws
- CVE-2026-105133 and CVE-2026-105134
- the two flaws that were chained in the attack chain
- XMRig
- the cryptocurrency miner deployed in the attacks
How the source tells it
The piece was largely factual, with a brief note of urgency from the vendor’s advice and CISA’s deadline.
- urgency a quoted call for immediate action and a fixed remediation deadline