Security AlertCritical
Attackers exploit patched AhsayCBS flaws to plant stealthy Python backdoor
Nov 10, 2026 · Summarized by Fundy Tech from 2 sources
The 30-second version
Huntress saw attackers use two patched AhsayCBS flaws to break in and drop a Python backdoor. The intrusion also installed miners, web shells, and remote access tools on backup servers.
Key points
- Huntress observed the attack in early October 2026.
- CVE-2026-105133 and CVE-2026-105134 were used together.
- Attackers deployed web shells, XMRig miners, and a Python backdoor.
Why it matters
If your business uses AhsayCBS, backup servers may be exposed to remote code execution and theft. Attackers appear to have targeted systems that store backups and credentials, which could slow recovery after an incident and put other systems at risk.
Who’s affected: AhsayCBS backup servers
What to do
- Patch AhsayCBS immediately.
- Review backup servers for web shells, miners, and remote access tools.
- Check Defender exclusions and unfamiliar scheduled tasks.
- Investigate any contact with the listed command-and-control domain.
Vulnerability IDs
Original reporting
Not sure if this affects you?
Fundy Tech helps businesses and households across Atlantic Canada stay patched, protected and up to speed. Tell us what you’re running and we’ll tell you straight whether you need to act.