AhsayCBS Releases Fixes for Exploited Web Shell, Crypto-Miner Flaws

Ahsay Backup has issued security updates for two vulnerabilities in AhsayCBS that threat actors exploited to deploy web shells and cryptocurrency miners. The flaws, CVE-2026-105133 and CVE-2026-105134, could be chained to bypass authentication and execute arbitrary commands. Earlier patches in August 2026 were incomplete, prompting new hotfixes. The U.S. CISA has added these vulnerabilities to its KEV catalog, mandating federal agencies to apply the fixes by October 17, 2026.