Singapore-based backup software vendor Ahsay has issued fresh security updates for two vulnerabilities in its AhsayCBS platform that attackers chained together to bypass authentication, execute arbitrary commands, plant web shells, and deploy XMRig cryptocurrency miners — after earlier fixes proved incomplete.
The flaws, tracked as CVE-2026-105133 and CVE-2026-105134, can be combined to defeat authentication checks and run attacker-supplied commands on vulnerable systems, according to a report from The Hacker News. AhsayCBS is the central server component of Ahsay's backup suite, widely deployed by managed service providers (MSPs) and IT teams to run client backup operations.
From partial fix to active exploitation
What makes this incident noteworthy is not just the vulnerabilities themselves, but the patch lifecycle around them. An initial round of fixes did not fully close the attack path, leaving systems that administrators believed to be patched still reachable by adversaries. With the door still ajar, attackers moved quickly: once access was gained, they dropped web shells for persistent footholds and quietly enlisted compromised servers for Monero mining.
The sequence is a textbook case of incomplete remediation being indistinguishable, from an operator's point of view, from no remediation at all. Administrators who checked their ticket lists and saw "patched" against these CVEs would have had no obvious signal that exploitation remained possible.
Backup infrastructure makes an attractive target for exactly this kind of intrusion. A backup server typically holds credentials and access paths to a large number of client systems, making it a single point of failure. Taking control of it can precede ransomware deployment, since disabling or corrupting backups removes an organisation's main recovery option — and, in this case, the server's own compute capacity was repurposed for cryptomining while the intrusion went unnoticed.
What administrators should do now
Organisations running AhsayCBS should treat the new vendor updates as mandatory and take several concrete steps:
- Verify the exact build installed. Do not rely on vendor release notes alone; confirm on the host that the running binary matches a version that includes the complete fix, given that an earlier patch for these CVEs was not fully effective.
- Assume prior compromise. Systems that were vulnerable before the complete fix shipped should be examined for web shells, unfamiliar processes, unexpected scheduled tasks, and outbound mining pool connections. An absence of known symptoms does not guarantee a clean system.
- Restrict exposure. Review firewall rules and network access lists to ensure AhsayCBS interfaces are not reachable from the open internet. Backup management consoles belong on management networks, behind access controls, not on public addresses.
- Review backup integrity. Since attackers had command execution on backup infrastructure, verify that backup sets are intact and that stored credentials and keys have been rotated.
A broader patch-management lesson
The wider takeaway for IT teams — including those managing backup fleets across multiple clients — is that closing a ticket is not the same as closing a vulnerability. Where a vendor has shipped more than one update for the same flaw, independent verification of the deployed version is the only reliable check. That principle applies well beyond this particular product.
Ahsay's updated versions address both CVEs. Organisations still running affected builds should apply them promptly and audit for indicators of the mining and web shell activity described above.
總部設於新加坡的備份軟件供應商 Ahsay 就其 AhsayCBS 平台的兩個漏洞發布了新的安全更新。攻擊者將兩個漏洞串聯利用，繞過身份驗證、執行任意指令、植入 Web Shell，並部署 XMRig 加密貨幣挖礦程式——而早前的修補措施被證實並不完整。
根據 The Hacker News 的報道，有關漏洞分別為 CVE-2026-105133 及 CVE-2026-105134，兩者可組合使用以繞過身份驗證檢查，並在有漏洞的系統上執行攻擊者提供的指令。AhsayCBS 是 Ahsay 備份套件的中央伺服器組件，獲管理服務供應商（MSP）及 IT 團隊廣泛部署，用以執行客戶端備份操作。
從不完整修補到遭受實際利用
是次事件值得關注之處，不僅在於漏洞本身，更在於圍繞漏洞的補丁生命週期。首輪修補並未能完全堵塞攻擊路徑，令管理員誤以為已完成修補的系統，實際上仍可被入侵者存取。大門仍然半掩之下，攻擊者隨即行動：一旦取得存取權，便植入 Web Shell 以建立持久立足點，並悄然利用被入侵的伺服器進行 Monero 挖礦。
是次事件堪稱教科書式的案例：從營運人員的角度來看，不完整的補救措施與完全沒有補救根本無法區分。管理員查看工單列表，見到相關 CVE 旁標示「已修補」，根本不會收到任何明顯信號，顯示漏洞仍可被利用。
備份基礎設施正是此類入侵的理想目標。備份伺服器通常存有大量客戶端系統的認證資料及存取途徑，構成單點故障。控制該伺服器往往是部署勒索軟件的前奏，因為停用或破壞備份會移除機構的主要復原選項——而今次事件中，伺服器本身的運算能力更被挪作加密貨幣挖礦之用，入侵過程一直未被察覺。
管理員現應採取的行動
運行 AhsayCBS 的機構應將供應商的新更新列為強制項目，並採取以下具體措施：
- 核實確切安裝版本。 不應單靠供應商的版本說明；須在主機上確認正在運行的二進位檔案，是否屬於包含完整修補的版本，因為早前針對這些 CVE 的補丁並未完全有效。
- 假設系統曾遭入侵。 在完整修補推出前曾有漏洞的系統，應檢查是否存有 Web Shell、陌生進程、非預期的排程任務，以及連往挖礦池的對外連線。沒有發現已知症狀，並不保證系統完全乾淨。
- 限制暴露範圍。 檢視防火牆規則及網絡存取清單，確保 AhsayCBS 的介面無法從公開互聯網存取。備份管理控制台應置於管理網絡之內，受存取控制保護，而非設於公開地址上。
- 檢查備份完整性。 由於攻擊者曾在備份基礎設施上執行指令，須核實備份集合是否完整，並確認已儲存的認證資料及金鑰均已更換。
更廣泛的補丁管理教訓
對 IT 團隊——包括跨多個客戶管理備份系統的團隊——而言，更廣泛的啟示是：關閉工單並不等於堵塞漏洞。當供應商就同一個漏洞發布多於一次更新時，對已部署版本進行獨立核實，是唯一可靠的檢查方法。此原則同樣適用於其他產品，遠不止於今次事件。
Ahsay 的更新版本已修復兩個 CVE。仍在運行受影響版本的機構，應盡快套用更新，並審查是否有上述挖礦及 Web Shell 活動的跡象。