Latest / The Digital Warfare Podcast
EP. 178: AhsayCBS Vulnerabilities Exploited to Deploy Webshells and Crypto Miners
Summary
Attackers are actively exploiting CVE-2026-105133 and CVE-2026-105134 in the AhsayCBS backup management platform. The vulnerabilities can be chained to bypass authentication and execute operating system commands, allowing attackers to deploy JSP webshells and cryptocurrency miners.
Observed attacks used XMRig, malicious persistence through MicrosoftEdgeUpdateSvc, and a PowerShell script designed to hide mining activity when Task Manager is opened. Researchers also found that AhsayCBS 10.3.4 remained vulnerable, despite earlier reports that the issues were fixed.
Administrators should…
The skinny
The skinny isn't ready yet — notes appear once the transcript is processed.