Huntress reports attacks against AhsayCBS backup management servers beginning October 7, with five organizations targeted by October 8. Its investigation links CVE-2026-105133 and CVE-2026-105134 to unauthorized access and code execution, followed by webshells and cryptocurrency mining.
An October 8 update says versions through 10.3.4 are affected, revising earlier information about that release. Huntress recommends restricting management access and investigating possible compromise. For affected hosts with evidence of intrusion, it recommends rebuilding from a trusted backup. Its report supplies detection rules and indicators; administrators should consult the current advisory when assessing their installed version.
NAOAT analysis
The operational concern extends beyond the cost of stolen processing time. A backup console is part of the machinery an organization expects to trust when another system fails. Incident handling should therefore examine both the compromised host and whether recovery arrangements depend on credentials or settings accessible from that host.
A useful review separates three questions: who can reach the management interface, whether an attacker has already reached it, and whether a clean recovery can be demonstrated. Closing an exposed route addresses future access through that route. It does not, by itself, answer the other two questions. Each requires its own evidence and an accountable owner.
For a managed service provider, the corresponding customer record should identify which installation serves which organization and what has actually been checked. A blanket statement that backups are running would be insufficient evidence of recovery readiness. A stronger result is a documented restore exercise using an independently trusted recovery path, accompanied by a clear account of the investigation’s scope. That gives the customer a concrete basis for understanding what service has been verified.