Ahsay Backup Rolls Out Full Patch After AhsayCBS Vulnerabilities Enabled Web‑Shell and Crypto‑Miner Intrusions

Ahsay Backup, headquartered in Singapore, has issued security updates that remediate two critical flaws in its AhsayCBS backup solution, flaws that attackers recently exploited to deploy web shells and XMRig crypto‑miner software on hijacked servers.

Identified as CVE‑2026‑105133 and CVE‑2026‑105134, the issues arise from weak input validation within AhsayCBS’s web console. An attacker without credentials can upload harmful scripts, thereby achieving remote code execution and the capacity to launch any binary on the vulnerable machine.

Within weeks of their identification, security analysts saw the vulnerabilities being exploited in active attacks. Threat actors used the web‑shell function to maintain persistent access and subsequently installed XMRig miners to extract Monero, a privacy‑centric cryptocurrency. Victims of AhsayCBS noted sudden increases in CPU load and unexplained outbound network traffic—typical indicators of unauthorized mining.

Earlier patches from Ahsay Backup only mitigated portions of the issue, leaving a remaining attack surface that continued to be abused. The newest release, deployed this week, completely fixes both CVE entries and adds extra hardening for the web‑based management console.

The security team at Ahsay is urging every client to install the fresh patches without delay and to audit system logs for evidence of earlier breaches. It also advises rotating passwords, shutting down superfluous services, and performing a comprehensive check of any files left behind by the web shells.

This episode highlights a growing pattern: backup and recovery products are becoming frequent targets, given their position at the intersection of vital data and network connectivity. Timely patch deployment, regular vulnerability assessments, and proper network segmentation continue to be key safeguards against these supply‑chain‑related threats.

Going forward, Ahsay Backup states it will keep watching for new threats and intends to publish additional hardening recommendations in the upcoming months. Analysts observe that, although the reaction came after the fact, it reflects mounting pressure on software vendors to place security at the forefront of solutions that protect corporate data.