#ahsay

October 10, 2026

AhsayCBS: the "fixed" version isn't. Huntress now says Ahsay 10.3.4, the current latest build, is still vulnerable to CVE-2026-105133 (auth bypass, public exploit) and CVE-2026-105134 (command injection), so the chain remains unpatched (earlier coverage). Attacks from 7 October across at least five customer environments dropped JSP webshells and XMRig disguised as edge.exe, persisted via a MicrosoftEdgeUpdateSvc service running a renamed NSSM, and used what Huntress believes is an AI-assisted PowerShell script that halts mining when Task Manager opens and kills it at 18:00 or after an hour overnight; one host also got the vulnerable WinRing0x64.sys driver. IoCs and four Sigma rules are published (BleepingComputer, Huntress). · Exploitation in the Wild