[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fUDr3mG9c_5klQbZs2L1ND-txRVhQzk6MCfif2NC6uCE":3},{"article":4,"iocs":44,"watch_terms":51,"solutions":52,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":31},"ccdf4549-7fd2-4249-bc0f-8de9335bd121","AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches","ahsaycbs-flaws-exploited-to-deploy-web-shells-get-new-fixes-after-incomplete-pat-ab68bb","Singapore-based Ahsay Backup has released security updates to address two security flaws in AhsayCBS that have been exploited by bad actors to drop web shells and XMRig cryptocurrency miners. The vulnerabilities in question are CVE-2026-105133 and CVE-2026-105134, which could be chained to sidestep authentication and execute arbitrary commands on affected systems. In a report published earlier","Ahsay Backup has released updated security patches for its AhsayCBS software to address two critical vulnerabilities (CVE-2026-105133 and CVE-2026-105134) that were being actively exploited. These flaws allow unauthenticated attackers to execute arbitrary commands, leading to the deployment of web shells and XMRig cryptocurrency miners. The initial patches released in August were found to be incomplete, prompting the new hotfix releases.","AhsayCBS flaws exploited for web shells and crypto miners receive new fixes after initial patches failed.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fahsaycbs-flaws-exploited-to-deploy-web.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhH_5A4EPZ4VVdF4dve5fMe4BwreUmtWCJQrgMiBdiZyoFInoZK_nO6ouOwLMCyyQPrXWE4_n3NE39b4C2UQi-G4uE3ufyv7A9IEYEp9O3ggTu7AyDRzOqwVqhLjISLvOTasPiAcdFafFtL7B5uoKtm8GPeFFxrKDupGCoqZJ2o88sUmaGbjKk6E3sJgIKD\u002Fs1600\u002Fbackup.jpg","2026-10-15T06:43:08+00:00","2026-10-15T10:00:15.843553+00:00",8,[17,20,23],{"name":18,"type":19},"AhsayCBS","product",{"name":21,"type":22},"Ahsay Backup","vendor",{"name":24,"type":25},"web shells","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":28,"name":29,"slug":30},null,"Vulnerabilities","vulnerabilities",[32,34,39],{"category":33},{"id":26,"icon":28,"name":29,"slug":30},{"category":35},{"id":36,"icon":28,"name":37,"slug":38},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":40},{"id":41,"icon":28,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,49],{"type":46,"value":47,"context":48},"cve","CVE-2026-105133","Vulnerability in AhsayCBS allowing command execution.",{"type":46,"value":50,"context":48},"CVE-2026-105134",[21,18],{"controls":53,"vendors":141},[54,83,112],{"slug":55,"name":56,"problem":57,"products":58},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[59,67,75],{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":84,"name":85,"problem":86,"products":87},"patch-management","Automated patch management","Known holes get closed in days, not months.",[88,96,104],{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":113,"name":114,"problem":115,"products":116},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[117,125,133],{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",[142],{"slug":126,"name":127,"logo_path":128,"roles":143},[144],"reported_by",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":161},"incomplete-patches-leave-backup-software-open-to-active-exploitation","Incomplete Patches Leave Backup Software Open to Active Exploitation","The AhsayCBS vulnerabilities highlight a critical failure in patch quality assurance, where an initial August fix was released without fully remediating the underlying flaws, leaving systems exposed to continued active exploitation. Attackers leveraged unauthenticated remote code execution to deploy web shells and cryptocurrency miners, demonstrating how incomplete patches can create a false sense of security. This is particularly damaging in backup software, where the integrity and availability of the system is foundational to organizational resilience. Organizations that applied the first patch and considered themselves protected remained vulnerable, underscoring the need to verify patch effectiveness and monitor for indicators of compromise even after patching.",[150,151,152,153,154,155,156,157,158,159,160],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SI-7: Software, Firmware, and Information Integrity","NIST AC-17: Remote Access","NIST SC-7: Boundary Protection","ITIL: Change and Release Management","ISO\u002FIEC 27001:2022 A.8.8: Management of Technical Vulnerabilities","OWASP Web Shell Detection Guidance",{}]