GoKawiilUnpatched AhsayCBS bugs let attackers plant webshells, crypto miners
Huntress researchers say attackers are chaining two AhsayCBS vulnerabilities—an authentication bypass (CVE-2026-105133) and an OS command injection flaw (CVE-2026-105134)—to compromise at least five organizations since October 7. After breaking in, attackers deployed JSP webshells and installed an XMRig cryptocurrency miner disguised as edge.exe, persisting via a fake Windows service.
GoKawiil's interpretation of the reporting above, not reported fact.
The flaws were supposedly patched in version 10.3.2, but Huntress found they still affect the current 10.3.4 release, meaning organizations running the latest version remain exposed. Because AhsayCBS is widely used by managed service providers, a successful compromise could give attackers a foothold into multiple downstream client networks they manage, not just a single victim.
- Two AhsayCBS vulnerabilities are being actively exploited together despite being marked as fixed in 10.3.2.
- Huntress confirmed the current 10.3.4 version remains vulnerable to both flaws.
- Attackers use an AI-assisted PowerShell script to hide a crypto-mining service from Task Manager and users.
Source: bleepingcomputer.com, 2026-10-09
Published there as: “Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.