Attackers chained two AhsayCBS bugs to run code and install a miner
Huntress says attackers started exploiting CVE-2026-105133 and CVE-2026-105134 in AhsayCBS on October 7, 2026, after the flaws were disclosed on October 4. They ran code, planted webshells, and installed a cryptominer.
What was reported
Huntress, in a report published October 8, 2026 and updated October 12, says NVD disclosed CVE-2026-105133 and CVE-2026-105134 on October 4, 2026. The first is an authentication weakness. The second lets an unauthenticated attacker run code as SYSTEM through the replication receiver. Huntress says attackers chained them.
Huntress first saw exploitation at 23:20:15 UTC on October 7, 2026. As of October 8 it had seen five organizations targeted. After access, attackers ran reconnaissance, dropped webshells, and installed an XMRig miner disguised as Microsoft Edge. Versions through 10.3.4 are affected. An earlier note that 10.3.4 was safe was withdrawn.
On October 12, Ahsay released hotfixes. Huntress says it checked that 10.3.4.45 closes the authentication-bypass entry point that was still open on earlier version 10 builds.
How to prevent it
Do not put a backup admin console on the public internet. Huntress says it verified that AhsayCBS 10.3.4.45 closes the authentication-bypass entry point on version 10, including 10.3.4.0. Ahsay recommends 9.15.2.70 for versions 7, 8, and 9; Huntress did not report testing that build. If you find signs of the miner or a webshell, rebuild the host from a backup you trust. Updating a machine an attacker already changed does not remove them.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.