GoKawiilUnpatched AhsayCBS bugs let attackers plant webshells, crypto miners
Huntress researchers say attackers are chaining two AhsayCBS vulnerabilities—an authentication bypass (CVE-2026-105133) and an OS command injection flaw (CVE-2026-105134)—to compromise at least five organizations since October 7. After breaking in, attackers deployed JSP webshells and installed an XMRig cryptocurrency miner disguised as edge.exe, persisting via a fake Windows service.