Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor
Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant.
The activity, observed by Huntress in early October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two vulnerabilities were released by Ahsay Backup in mid-October 2026.
Entenda a falha
A vulnerabilidade
Two vulnerabilities in AhsayCBS, the Ahsay Backup server product, CVE-2026-105133 and CVE-2026-105134, were chained to bypass authentication and run arbitrary commands on the affected server. The articles do not say which CVE does what, give their CVSS scores, or list the affected and fixed versions. Ahsay Backup released patches in mid-October 2026. The flaws are assessed to have been exploited as zero-days before the patches.
Como funciona
The articles do not describe the internals of either flaw. They only say the chain first bypasses authentication and then gives command execution on the AhsayCBS host. After that, the attacker dropped JSP web shells, miners, tunneling tools and a Python implant on the server.
Por que é vulnerável
The articles do not state the root cause of either CVE, why they went unnoticed, or what the patches change. The only stated result is that authentication could be bypassed and commands run.
Como foi descoberta
Huntress observed the exploitation in early October 2026, first as a smash-and-grab that deployed web shells and XMRig miners. It then saw a broader intrusion with a custom Python implant, and Huntress researcher Jonathan Semon described the activity. The two flaws are assessed to have been used as zero-days, and Ahsay Backup patched them in mid-October 2026. The articles do not say how the flaws were reported to the vendor. The details were published on 10 November 2026.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
A working exploit for the chain was used in real attacks by an unknown threat actor, who gained command execution and left web shells, two XMRig miners, GOST and Chisel tunnels, remote access tools and a sandbox-evading Python backdoor. The articles do not mention any published PoC or exploit code, so it is treated as private. Because exploitation was already happening before the patches, any unpatched AhsayCBS server should be patched urgently and checked for the indicators Huntress described.
Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 15:15.
Linha do tempo
-
Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor
ler a análise desta fonte ocultar
Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant.
The activity, observed by Huntress in early October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two vulnerabilities were released by Ahsay Backup in mid-October 2026.