Breaking
Latest tech news from South Africa and around the world•Stay updated with breaking technology developments•Innovation and digital transformation news•AI, gaming, and gadget updates daily•Crypto and fintech news from Africa•
SA Tech News Desk
Ahsay released hotfixes for AhsayCBS after CVE-2026-105133 and CVE-2026-105134 were exploited in the wild. Earlier partial patches are not enough.
Ahsay has issued new hotfixes for AhsayCBS backup servers after critical vulnerabilities were exploited in the wild. Partners running affected versions are being told to patch immediately, reboot, and treat exposed management interfaces as high risk until the updates are applied.
The vulnerabilities are tracked as CVE-2026-105133 and CVE-2026-105134. Security researchers and incident responders reported active attacks beginning around 7 October 2026, after the CVE records were published on 4 October. Observed post-exploitation behaviour has included reconnaissance, webshells and XMRig cryptomining — not a confirmed mass ransomware wipe of backup archives in the Huntress telemetry described publicly, but still SYSTEM-level access on a backup server.
For South African MSPs and enterprises that still run AhsayCBS as a central backup appliance, the operational question is blunt: is the management interface reachable from the internet, and which build is installed?
Ahsay’s mid-October updates state that earlier patches — including builds marketed as addressing the issue — did not fully close both CVEs. Partners therefore cannot assume they are safe merely because they installed v9.15.2.59 or v10.3.4.0.
Current vendor guidance, as published on Ahsay’s announcement pages, is:
Hotfix downloads require a valid Ahsay partner portal login. That gatekeeping is inconvenient in an incident, but it is how the vendor is distributing the fixes. Huntress has reported independent verification that the v10.3.4.45 hotfix blocks the authentication-bypass entry point used in the observed attack chain.
Ahsay also published compromise-assessment and recovery guidance after the hotfixes, including a recommendation to rebuild servers that show indicators of compromise rather than relying on file deletion alone.
Backup infrastructure sits at the centre of recovery plans. Attackers who land on a backup server can mine cryptocurrency, plant persistence, or — in other campaigns — interfere with restore paths. Even when a specific wave appears focused on resource hijacking, SYSTEM privileges mean data integrity cannot be assumed without investigation.
AhsayCBS is a centralised management server for Ahsay backup software. When its web management surface is exposed, an unauthenticated or poorly authenticated remote chain becomes an MSP-wide problem: one appliance can sit in front of many customer backup sets. That concentration is why patching and network restriction matter more here than a casual “restart the agent” habit.
South African service providers often inherit mixed version estates — older v7/v8 boxes that were “stable,” partner-branded appliances, and internet-facing portals opened for remote administration. Those are exactly the conditions under which a CVE with active exploitation turns from vendor bulletin into weekend work.
Keep the public chronology visible so patch claims can be checked:
If a ticket says “we patched last week” without a build number, ask which hotfix string is running after reboot. Build marketing names and hotfix build numbers are easy to confuse under pressure.
First, inventory every AhsayCBS instance: version, hotfix level, whether the management UI is internet-reachable, and who holds partner-portal credentials to fetch the update.
Second, apply the matching hotfix and reboot. For v7/v8, plan the upgrade path to v9.15.0.0 before the v9 hotfix. Do not stop at an older “security” build that Ahsay has already said was incomplete.
Third, restrict management access to trusted IPs or VPN. Edge exposure was central to the exploitation pattern described by responders.
Fourth, hunt for compromise indicators using Ahsay’s guidance and your EDR. Huntress and vendor notes describe webshells, suspicious services and miner binaries among the artefacts. If indicators appear, treat the host as compromised. Ahsay’s stronger recovery recommendation is a full OS rebuild, clean AhsayCBS install at a patched level, and restore of configuration from an Auto Save predating suspicious activity.
Fifth, tell customers the difference between “backup agents are still running” and “the backup server was not taken over.” Those are not the same assurance.
This article does not claim every Ahsay customer in South Africa was breached. It does not claim ransomware wiped national backup estates. It does not invent victim names. The confirmed public picture is narrower: critical CVEs, active exploitation, vendor hotfixes that supersede incomplete earlier patches, and clear instructions to reboot and investigate.
Nor is a hotfix a substitute for architecture hygiene. Backup servers that must be remotely administered should not present an open management plane to the whole internet. Patching closes the known chain; exposure policy reduces the next one.
Hold the ledger: CVE-2026-105133 and CVE-2026-105134; active attacks reported from 7 October 2026; apply AhsayCBS hotfixes v10.3.4.45 or v9.15.2.70 as appropriate; reboot; restrict management access; investigate and rebuild if compromised. Earlier partial patches are not enough. For South African MSPs, the useful update is the build number on each CBS host after reboot — not a screenshot of a vendor email.
Sources: Ahsay security announcements (12–13 October 2026); Huntress reporting on AhsayCBS exploitation; Horizon3 / CVE technical summaries.
Source: SA Tech News
