Attackers are chaining two AhsayCBS flaws — CVE-2026-105133 (authentication bypass) and CVE-2026-105134 (OS command injection) — to get unauthenticated remote code execution with NT AUTHORITY\SYSTEM privileges. Huntress saw at least five organizations targeted from October 7, 2026. After breaking in, they drop JSP web shells and XMRig miners disguised as edge.exe, plus an AI-written PowerShell script that kills Windows Task Manager to hide the mining. The scary part: the August 2026 patches did not fully work — Huntress confirmed even version 10.3.4 is still vulnerable. New hotfixes are out: v10.3.4.45 and v9.15.2.70, reboot required. CISA added both flaws to its KEV catalog with a patch deadline of October 17, 2026 — tomorrow. This free CVE check tool tells you whether your build is vulnerable and what to hunt for. Free, no signup.
Key figure: Reported cybercrime losses in the United States reached $16.6 billion in 2024, up 33% from 2023 (FBI IC3, 2024 Internet Crime Report).
The AhsayCBS flaw is cybersecurity news because attackers are actively installing XMRig crypto miners on vulnerable backup servers — and a compromised backup server means your last line of defense is in enemy hands. Miners also signal deeper access: if attackers can mine cryptocurrency on your box, they can also steal or encrypt your backups.
edge.exe and the service MicrosoftEdgeUpdateSvc exploits admin trust in Microsoft-signed-looking names.This page checked one threat. BreachHunter tracks attacker infrastructure, malicious domains, and compromise indicators — the IOC-hunting side of stories like AhsayCBS.
CVE-2026-105133 is an improper authentication vulnerability in AhsayCBS's checkSysPwd() function; CVE-2026-105134 is an OS command injection in the Replication Receiver component (/rps/api/json/UpdateReceivers.do). Attackers chain them to bypass authentication and execute arbitrary OS commands with NT AUTHORITY\SYSTEM privileges — no login required.
Yes. Huntress confirmed that the August 2026 patches (9.15.2.59 and 10.3.4.0) did not fully fix the flaws, and that even the latest listed version 10.3.4 remained exploitable — effectively a zero-day. The complete fixes are the v10.3.4.45 hotfix (v10 branch) and the v9.15.2.70 hotfix (v7/v8/v9 branches), followed by a server reboot.
Per Huntress and Bitdefender MDR: plant JSP web shells in the AhsayCBS web app directories, stage payloads in C:\Users\Public, install XMRig cryptominers disguised as edge.exe / msedge.exe (with a service named MicrosoftEdgeUpdateSvc), drop an AI-assisted PowerShell script (Taskgmr.ps1) that kills Windows Task Manager to hide mining, install OpenSSH for a backdoor, and create services, scheduled tasks, and elevated accounts for persistence.
CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalog, requiring US federal agencies to patch by October 17, 2026. Private organizations should treat the same date as the urgency bar — exploitation began October 7, 2026, and Huntress saw at least five organizations targeted by October 8.
A CVE checker is a free tool that tells you whether your software is affected by a published CVE — a publicly known cybersecurity vulnerability. It compares your version or configuration against the official advisory and gives you a patched, vulnerable, or unknown verdict in about 30 seconds.
Find your exact version number, then compare it against the vendor's security advisory or the NVD entry for the CVE. The fastest way is a CVE checker built for that product: paste your version and get an instant verdict against the published version tables.
You are affected when you run a vulnerable version and the vulnerable component is reachable or enabled — for example, open sign-ups, an exposed management port, or a vulnerable app installed. A CVE checker gives you the version verdict in seconds; the advisory's conditions tell you whether that verdict means real exposure.