Reported by 13 outlets

Timeline

1. original reporting

   CVE-2026-105134 (CRITICAL): Ahsay AhsayCBS ≤10.3.2 suffers OS command injection in Replication Receiver (/rps/api/json/UpdateReceivers.do).

   radar.offseq.com · 9d ago · October 4th, 2026

   CVE-2026-105134 (CRITICAL): Ahsay AhsayCBS ≤10.3.2 suffers OS command injection in Replication Receiver (/rps/api/json/UpdateReceivers.do).

   via Mastodon https://radar.offseq.com/threat/cve-2026-105134-os-command-injection-in-ahsay-ahsaycbs-a9df873cc55c0ce9

2. update from radar.offseq.com

   AhsayCBS https:// radar.offseq.com/threat/a-flaw -has-been-found-in-ahsay-ahsaycbs-up-to-1032-cve-2026-105134-a9f0def985d0c48e # OffSeq # CV

   radar.offseq.com · 8d ago · October 5th, 2026

   AhsayCBS https:// radar.offseq.com/threat/a-flaw -has-been-found-in-ahsay-ahsaycbs-up-to-1032-cve-2026-105134-a9f0def985d0c48e # OffSeq # CV

   via Mastodon https://radar.offseq.com/threat/a-flaw-has-been-found-in-ahsay-ahsaycbs-up-to-1032-cve-2026-105134-a9f0def985d0c48e

3. update from www.huntress.com

   (huntress.com) Exploitation of AhsayCBS Vulnerabilities Leads to Unauthenticated RCE and Cryptomining Operations In brief - This article des

   www.huntress.com · 5d ago · October 8th, 2026

   (huntress.com) Exploitation of AhsayCBS Vulnerabilities Leads to Unauthenticated RCE and Cryptomining Operations In brief - This article des

   via Mastodon https://www.huntress.com/blog/ahsaycbs-flaws-exploit

4. update from securityonline.info

   Threat actors are actively abusing critical AhsayCBS vulnerabilities in the wild to deploy cryptominers. Patch unpatched AhsayCBS vulnerabil

   securityonline.info · 5d ago · October 9th, 2026

   Threat actors are actively abusing critical AhsayCBS vulnerabilities in the wild to deploy cryptominers. Patch unpatched AhsayCBS vulnerabil

   via Mastodon https://securityonline.info/ahsaycbs-vulnerabilities-exploited/?utm_source=mastodon&utm_medium=jetpack_social

5. update from securityweek.com

   Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

   securityweek.com · 4d ago · October 9th, 2026

   Hackers have been exploiting two unpatched vulnerabilities in the AhsayCBS backup solution for remote code execution (RCE), cybersecurity firm Huntress warns. A centralized cloud backup server management console developed by Ahsay Systems, AhsayCBS provides backup policy, storage, and user management and is popular among MSPs and system integrators. Tracked as CVE-2026-105133 and CVE-2026-105134 , the exploited security defects allow attackers to manipulate arguments in certain functions of the tool to bypass authentication and inject OS commands. They were disclosed on October 4, when NIST warned that exploit code targeting them had been released, and that all AhsayCBS versions up to 10.3.2 were affected. “Until a patch is available, we recommend restricting access to the management interface and investigating for signs of compromise,” Huntress says. According to Huntress, threat actors are chaining the two bugs to access vulnerable systems and execute arbitrary code on them. As of October 8, at least five organizations had been targeted.

6. update from beyondmachines.net

   Threat Actors Chain AhsayCBS Vulnerabilities to Deploy Webshells and Cryptominers Threat actors are chaining two vulnerabilities in AhsayCBS

   beyondmachines.net · 4d ago · October 9th, 2026

   Threat Actors Chain AhsayCBS Vulnerabilities to Deploy Webshells and Cryptominers Threat actors are chaining two vulnerabilities in AhsayCBS

   via Mastodon https://beyondmachines.net/event_details/threat-actors-chain-ahsaycbs-vulnerabilities-to-deploy-webshells-and-cryptominers-o-j-b-o-b/gD2P6Ple2L

7. mentioned by fawkes.rocks

   AhsayCBS flaws exploited in the wild, no patch available https:// fawkes.rocks/2026/10/09/ahsayc bs-flaws-exploited-in-the-wild-no-patch-ava

   fawkes.rocks · 4d ago · October 9th, 2026

8. update from www.huntress.com

   Huntress is reporting AhsayCBS CVE-2026-105133 and CVE-2026-105134 exploitation to drop web shells and XMRig cryptominer: Huntress is seeing

   www.huntress.com · 4d ago · October 9th, 2026

   Huntress is reporting AhsayCBS CVE-2026-105133 and CVE-2026-105134 exploitation to drop web shells and XMRig cryptominer: Huntress is seeing

   via Mastodon https://www.huntress.com/blog/ahsaycbs-flaws-exploit

9. update from bleepingcomputer.com

   Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto

   bleepingcomputer.com · 4d ago · October 9th, 2026

   Threat actors are exploiting one critical and one medium-severity vulnerability still unpatched in the AhsayCBS backup management platform to deploy webshells and cryptocurrency miners. AhsayCBS is typically used by managed service providers (MSPs) and system integrators. The malicious activity was observed on October 7, and targeted at least five organizations. Both vulnerabilities are reported as fixed in AhsayCBS 10.3.2, but researchers at managed detection and response company (MDR) Huntress found that they also affect Ahsay 10.3.4, currently the latest version. "After further investigation, Huntress has determined that Ahsay 10.3.4 is also affected by these vulnerabilities," Huntress says in an update today. After gaining access, Huntress observed the attacker perform reconnaissance, deploy Java Server Page (JSP) webshells, and download the XMRig miner disguised as edge.exe. The miner persists on the host via a service named ‘MicrosoftEdgeUpdateSvc,’ which runs msedge.exe, identified by Huntress as a modified copy of the legitimate Non-Sucking Service Manager (NSSM) utility. A PowerShell file (Tas

10. mentioned by cyberworldops.eu

    Huntress reports active exploitation of AhsayCBS CVE-2026-105133 and CVE-2026-105134 chained for auth bypass and OS command execution. Attac

    cyberworldops.eu · 4d ago · October 9th, 2026

11. mentioned by www.bleepingcomputer.com

    🤖 Unpatched AhsayCBS backup platform: attackers exploit one critical + one medium flaw to drop webshells and XMRig miners disguised as Micro

    www.bleepingcomputer.com · 4d ago · October 9th, 2026

12. update from gbhackers.com

    Two AhsayCBS Zero-Day Vulnerabilities Actively Exploited to Take Over Backup Servers

    gbhackers.com · 3d ago · October 10th, 2026

    Observed intrusions have deployed web shells and cryptocurrency miners, exposing weaknesses in the infrastructure that centrally manages backup operations. According to Field Effect’s October 9, 2026, report, exploitation began […] The post Two AhsayCBS Zero-Day Vulnerabilities Actively Exploited to Take Over Backup Servers appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

13. mentioned by threatnoir.com

    ⚠️ CRITICAL: Unpatched AhsayCBS Vulnerabilities Exploited in the Wild Attackers are actively exploiting two unpatched remote code execution

    threatnoir.com · 3d ago · October 10th, 2026

14. update from cyberunit.com

    (cyberunit.com) Active Exploitation of Critical AhsayCBS Backup Software Vulnerabilities: Unauthenticated RCE and Webshell Deployment In bri

    cyberunit.com · 3d ago · October 10th, 2026

    (cyberunit.com) Active Exploitation of Critical AhsayCBS Backup Software Vulnerabilities: Unauthenticated RCE and Webshell Deployment In bri

    via Mastodon https://cyberunit.com/insights/ahsaycbs-backup-zero-day-msp-attack-october-2026/

15. mentioned by cyberunit.com

    (cyberunit.com) Active Exploitation of Critical AhsayCBS Backup Software Vulnerabilities: Unauthenticated RCE and Webshell Deployment In bri

    cyberunit.com · 3d ago · October 10th, 2026

16. mentioned by www.securityweek.com

    They exploited the Replication Receiver API like it was a skippable mechanic. IT IS NOT A SKIPPABLE MECHANIC. Restrict API access to trusted

    www.securityweek.com · 3d ago · October 10th, 2026

17. mentioned by suriq.io

    🔴 EXPLOITED AhsayCBS backup servers are under active attack. Two chained flaws give code execution as SYSTEM on an exposed console, no login

    suriq.io · 2d ago · October 11th, 2026

18. update from gbhackers.com

    Critical WordPress Bricksforge Flaw Lets Unauthenticated Attackers Execute Remote Code

    gbhackers.com · 1d ago · October 12th, 2026

    This flaw allows unauthenticated users to upload malicious files and execute arbitrary PHP code. It is tracked as CVE-2026-85097 and has a CVSS score of 10.0, affecting versions up to 3.1.8.9. Administrators are advised to upgrade to version 3.1.8.10 or later.

19. update from meterpreter.org

    Discover how the AhsayCBS backup server hack utilizes zero-day flaws to deploy stealthy XMRig crypto miners and web shells. Learn mitigation

    meterpreter.org · 1d ago · October 12th, 2026

    Discover how the AhsayCBS backup server hack utilizes zero-day flaws to deploy stealthy XMRig crypto miners and web shells.

20. update from securityweek.com

    Bricksforge WordPress Plugin Vulnerability Exploited in the Wild

    securityweek.com · 1d ago · October 12th, 2026

    A critical vulnerability in the Bricksforge WordPress plugin is being exploited in the wild, according to WordPress security company Patchstack. This can allow threat actors to take full control of the targeted WordPress websites. The security hole was patched with the release of version 3.1.8.10. Bricksforge is a commercial add-on for the Bricks visual site builder that layers extra tools onto WordPress sites, such as custom forms, animations, an email designer, and admin-area pages. “Two clusters stand out in our telemetry,” Patchstack explained. “In the first, 44 IPs sent 56 requests with identical payloads within seconds of each other. In the second, three IPs tested 25 variations of PHP extensions and encodings against the same temporary file.” The company added, “Both patterns point to automated exploitation over rotating proxies or distributed infrastructure. They do not, on their own, attribute the activity to a single threat actor.” It’s not uncommon for threat actors to target WordPress vulnerabilities shortly after patches are released, including plugin flaws and weaknesses af