Someone is chaining two AhsayCBS bugs to own backup servers, and it starts with a fake Edge

By David - Published: 10 October 2026

The backup server is the box nobody patches in a hurry and nobody expects to be attacked, which is a good reason for an intruder to start there. This week The Hacker News reported, citing Huntress, that two flaws in Ahsay's AhsayCBS are being chained to get commands running on exposed servers, and that the people doing it are mostly after CPU time.

What was found

The pair are CVE-2026-105133, an authentication weakness in a password-check routine scored 5.5 on CVSS v4, and CVE-2026-105134, an OS command injection in the Replication Receiver scored 9.3. Alone the first is a modest bug. Together they let a remote attacker skip the login and run what they like. The identifiers were only published on 4 October.

Huntress says exploitation began late on 7 October, UTC, and by the next day it had counted around five organisations hit. The NVD entries say the fix arrived in 10.3.4, but Huntress reports that release is affected as well, which is why the write-ups call these zero-days. Check the vendor's current advice before you trust a version number, because the picture may have moved since the story ran.

What the intruders did next

The follow-on activity is routine and a little grubby: reconnaissance, a web shell, then a cryptominer saved as edge.exe so that it looks like Microsoft Edge in a process list. A PowerShell script, Taskgmr.ps1, pulled in with curl, stops the miner whenever Task Manager is open. Huntress thinks the script may have had machine help writing it. In at least one case certutil.exe was used to fetch the WinRing0x64.sys driver, a well-worn route to low-level hardware access for squeezing out mining performance.

Miners are the benign end of this. The same access sits on the one server that holds copies of everything the business wants back after a ransomware event. Someone who wanted to delete or encrypt backups instead would have had the same door open.

What to do on Monday

• Find out whether you run AhsayCBS at all, including copies a managed provider operates for you. Ask the question in writing.
• Take the management interface off the internet. Put it behind a VPN or an allow-list of fixed addresses, which is the mitigation Huntress points to while no clean patch exists.
• Hunt for edge.exe outside the Edge install folder, Taskgmr.ps1, WinRing0x64.sys in a temp directory, unexpected web shells in the application folders, and any certutil downloads from that host. The Huntress write-up has fuller indicators.
• Verify your backups from somewhere else. If the server was reachable, restore a sample from an offline or immutable copy and make sure it still opens.
• Rotate whatever credentials and keys the backup server stores for the systems it protects, since those are what a patient attacker would try to use next.

The wider lesson is old but keeps getting re-learned: backup consoles are privileged infrastructure and need the same exposure review as a VPN gateway. If you want a second pair of eyes on yours, write to sales@halfteck.com.