October 9, 2026
- Huntress reports active exploitation of CVE-2026-105133 and CVE-2026-105134, the AhsayCBS backup-server RCE pair, across five customer environments — webshells, an XMRig miner masquerading as Microsoft Edge, and what it describes as an AI-assisted PowerShell script that watches for Task Manager and kills it if left open overnight (Huntress). It later found that 10.3.4 is also affected — the version customers had been told to upgrade to — and now advises restricting the management interface and hunting for compromise (update) (earlier coverage). · Vulnerabilities & Exploitation
in Third NetScaler RCE in a Month Lands on the Same SAML Surface