AhsayCBS Vulnerabilities Exploited for Intrusion and Crypto Mining

• •Two critical vulnerabilities in AhsayCBS were exploited for a large-scale intrusion.
• •Attackers deployed multiple webshells and XMRig miners on compromised systems.
• •Patches were released after the exploitation occurred, leaving potentially compromised systems vulnerable.

In October 2026, threat actors exploited two vulnerabilities in AhsayCBS, CVE-2026-105133 and CVE-2026-105134, to execute arbitrary commands and deploy malicious tools. The attack involved a sophisticated intrusion with multiple webshells, XMRig cryptocurrency miners, and a Python-based implant. Ahsay released patches for these vulnerabilities in mid-October 2026, but the exploitation occurred prior to this. The attackers utilized various webshell families to maintain persistence and control over the compromised systems, which were primarily backup servers. The incident highlights the need for organizations to search for potential artifacts left by attackers if they were exposed before patching. Current investigations indicate that the attack was more extensive than initially reported, involving multiple layers of compromise.