Ahsay Backup Rolls Out Full Patch After AhsayCBS Vulnerabilities Enabled Web‑Shell and Crypto‑Miner Intrusions

Ahsay Backup, operating out of Singapore, has released a bundle of security patches that seal two critical flaws in its AhsayCBS backup solution, flaws that were recently exploited by attackers to drop web shells and XMRig crypto‑miners onto hijacked servers.

Identified as CVE‑2026‑105133 and CVE‑2026‑105134, the issues arise from inadequate input validation within AhsayCBS’s web console. An attacker without credentials can upload hostile scripts, thereby achieving remote code execution and the capacity to launch any binary on the compromised host.

Within weeks of being disclosed, security analysts saw the weaknesses actively exploited in real‑world attacks. Threat actors used the web‑shell function to gain lasting access, subsequently installing XMRig miners to mine Monero, a privacy‑centric coin. Victims of AhsayCBS noted sudden CPU spikes and mysterious outbound traffic, classic signs of unauthorized mining activity.

The first set of patches from Ahsay Backup mitigated some aspects of the issue yet left portions of the attack surface exposed, allowing further abuse. This week’s comprehensive update resolves both CVE entries completely and adds extra hardening for the web‑based management console.

Ahsay’s security personnel are urging every client to install the fresh patches without delay and to audit system logs for evidence of earlier breaches. They also advise rotating passwords, shutting down superfluous services, and performing a detailed sweep for any files left by the web shells.

This episode highlights a growing pattern: backup and recovery tools are becoming prime targets since they sit at the crossroads of vital data and network connectivity. Timely patching, regular vulnerability scans, and network segmentation stay crucial safeguards against these supply‑chain‑proximate threats.

Going forward, Ahsay Backup states it will keep watching for new threats and intends to publish additional hardening recommendations in the next few months. Analysts observe that, although the reaction arrived late, it signals mounting pressure on vendors to place security at the forefront of solutions that protect corporate data.