# Ahsay issues new hotfixes after exploited backup flaws survived patches

_Published Thursday, October 15, 2026 at 5:46 AM EDT · Security · Latest · Tier 2 — Notable_

![Ahsay issues new hotfixes after exploited backup flaws survived patches — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhH_5A4EPZ4VVdF4dve5fMe4BwreUmtWCJQrgMiBdiZyoFInoZK_nO6ouOwLMCyyQPrXWE4_n3NE39b4C2UQi-G4uE3ufyv7A9IEYEp9O3ggTu7AyDRzOqwVqhLjISLvOTasPiAcdFafFtL7B5uoKtm8GPeFFxrKDupGCoqZJ2o88sUmaGbjKk6E3sJgIKD/s1700-nu-rw-lo-l85-e365/backup.jpg)

Ahsay Backup has released new AhsayCBS hotfixes after confirming that August patches incompletely addressed two vulnerabilities exploited to install web shells and XMRig cryptocurrency miners. Attackers chained CVE-2026-105133 and CVE-2026-105134 to bypass authentication and run arbitrary commands on exposed systems, according to Huntress.

The new fixes are AhsayCBS v10.3.4.45 and v9.15.2.70. Huntress independently verified that the v10.3.4.45 hotfix mitigates the attack chain's initial entry point, which remained vulnerable in previous v10 versions. Ahsay instructs customers to reboot after applying the hotfix. CISA has added both flaws to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by October 17, 2026.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/ahsaycbs-flaws-exploited-to-deploy-web.html)

---
Canonical: https://techandbusiness.org/newswire/0KFPeLCBflrLSzpoRimLaj
Published: 2026-10-15T09:46:30.347Z
Story chronology: 2026-10-15T06:43:08.000Z
Retrieved: 2026-10-15T12:24:10.189Z
Publisher: Tech & Business (techandbusiness.org)