Ahsay releases new fixes for AhsayCBS flaws exploited to drop web shells

Ahsay Backup, a Singapore-based vendor, has released new security updates for AhsayCBS, its backup management platform. The updates address two vulnerabilities, CVE-2026-105133 and CVE-2026-105134, which attackers have already exploited.

What is known

According to the report, the two flaws can be chained to sidestep authentication and then execute arbitrary commands on an affected system. Threat actors have used this path to place web shells and XMRig cryptocurrency miners on compromised servers. The headline indicates that the new fixes were needed because earlier patches did not fully close the issues.

The source excerpt does not provide further technical detail, affected version numbers or the scale of exploitation, so organisations should consult the vendor's own advisory for those specifics.

Why it matters

Backup platforms hold privileged access and copies of sensitive data, which makes a compromise there more serious than on an ordinary server. A web shell gives an attacker a persistent foothold, so patching alone may not remove an intruder who is already present. The fact that earlier patches were incomplete also means that teams who applied them should not assume they are protected.

Recommended approach

Treat this as a patch-and-verify exercise: confirm the exact version you run, apply the latest vendor update, and check for signs of prior compromise before returning the system to normal operation.