companyAhsay
suspectedlowVulnerabilityFirst reported Oct 12, 2026
AhsayCBS: critical flaws exploited to deploy webshells and XMRig miners
Attackers are exploiting two flaws in AhsayCBS backup servers to execute commands, plant webshells and install XMRig cryptocurrency miners disguised as Microsoft Edge. Huntress first observed exploitation on October 7, 2026 at 23:20:15 UTC and by October 8 had seen five organizations targeted, with attackers establishing persistence.
Members only
The full record: the timeline and 2 linked reports
- Every update as it happened, with the status at each step
- Every report behind the record, newest first
- Alerts the moment Ahsay — or anything else you track — is hit again
A free account is all it takes — no card, one minute.