Critical

Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoor

The Hacker News

November 10, 2026 at 4:00 PM

Actively Exploited

Overview

Cybersecurity researchers have reported an attack exploiting two vulnerabilities in AhsayCBS, a backup software solution. This attack, observed by Huntress in early October 2026, utilized CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute unauthorized commands on compromised systems. The attackers deployed a Python-based backdoor capable of evading sandbox detection, which raises significant concerns for organizations using AhsayCBS. The vulnerabilities have been patched, but the incident serves as a reminder for companies to regularly update their software and monitor for any signs of compromise. Users of AhsayCBS should ensure they have installed the latest updates to protect against these exploits.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: AhsayCBS backup software, versions affected not specified.
Action Required: Patches for CVE-2026-105133 and CVE-2026-105134 have been released.
Timeline: Disclosed on October 2026

Original Article Summary

Cybersecurity researchers have disclosed details of an attack that exploited two now-patched vulnerabilities in AhsayCBS to deliver a Python-based implant. The activity, observed by Huntress in early October 2026, involves the exploitation of a chain comprising CVE-2026-105133 and CVE-2026-105134 to bypass authentication and execute arbitrary commands on affected systems. Patches for the two

Impact

AhsayCBS backup software, versions affected not specified.

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Disclosed on October 2026

Remediation

Patches for CVE-2026-105133 and CVE-2026-105134 have been released. Users should update their AhsayCBS software to the latest version to mitigate risks associated with these vulnerabilities.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Exploit, Update.

Read Original Article

Related Coverage

Git Patches Flaw That Lets Malicious Repositories Execute Code During Recursive Clones

The Hacker News

A vulnerability in Git, tracked as CVE-2026-111760, allows malicious repositories to execute arbitrary code on users' systems during recursive cloning. This issue arises from an integer truncation in how Git manages its index, particularly affecting the cloning of repositories along with their submodules. Git has addressed this flaw in version 2.56.1 and has also released fixes for earlier versions ranging from 2.50 to 2.55. Users who clone repositories recursively should update to the latest version to protect themselves from potential exploitation. This incident highlights the risks associated with open-source software, where malicious actors can exploit vulnerabilities to execute harmful code on unsuspecting users' machines.

Nov 10, 2026

SGLang RCE Exploit Breaches NEAR AI, Steals Data From 18 Agents and About 100 Users

The Hacker News

Last Sunday, an attacker exploited a remote code execution vulnerability in SGLang, an open-source inference engine, to gain unauthorized access to a NEAR AI inference server. This breach allowed the attacker to execute code and potentially view sensitive requests being processed on the server, including those made in a confidential mode designed to enhance privacy through a trusted execution environment. As a result, data from 18 agents and around 100 users was compromised. This incident raises serious concerns about the security of open-source software and the potential risks involved in handling sensitive data. Companies using SGLang or similar technologies need to assess their security measures to prevent future breaches.

Nov 10, 2026

Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem

The Hacker News

Researchers at Check Point have identified three espionage campaigns linked by shared infrastructure and malware known as Sparrow. These campaigns have primarily targeted telecommunications companies, government bodies, military organizations, research institutions, and critical infrastructure across Latin America, Asia, and Europe over the past year. The clusters, named SilentDelivery, have been using similar malware code, indicating a coordinated effort from a group with ties to China. The implications of these attacks are serious, as they not only threaten sensitive data and national security but also highlight the ongoing risk to critical sectors worldwide. Organizations in these sectors should remain vigilant and enhance their security measures to protect against potential breaches.

Nov 10, 2026

Blind Eagle Uses Fake Court Notices to Deliver Remote Access Trojan Across Latin America

The Hacker News

The cybercriminal group known as Blind Eagle has launched a new campaign targeting organizations across Latin America. They are using phishing tactics that mimic court-related notifications, such as court summons and fiscal notices, to trick users into downloading a remote access trojan (RAT). This RAT is linked to known malware variants like AsyncRAT and DCRat. The phishing messages are crafted in Portuguese and Spanish, making them particularly effective against local targets. As organizations fall victim to these tactics, sensitive data could be compromised, highlighting the need for enhanced cybersecurity measures in the region.

Nov 10, 2026

Apple Patches iMessage Group Chat Privacy Flaws and Bluetooth Pairing Vulnerabilities

The Hacker News

Apple has addressed two significant vulnerabilities in iMessage that could compromise group chat privacy. The first flaw allowed a remote attacker to join an existing group chat and intercept messages. The second issue permitted someone newly added to a group to access messages sent before their addition. These vulnerabilities affect various Apple devices, including the iPhone XS, XS Max, XR, and the iPad (7th generation). Users need to update their devices to ensure they are protected against these privacy risks, as unpatched devices could allow unauthorized access to private conversations.

Nov 10, 2026

SAP Patches Four CVSS 10.0 Flaws, Including Two Enabling Remote Code Execution

The Hacker News

SAP has released patches for four vulnerabilities rated 10.0 on the CVSS scale, indicating they are extremely severe. These flaws, which can be exploited without requiring user login, mainly affect the SAP NetWeaver application server and the Web Dispatcher, a component that routes web requests to the server. Attackers could potentially exploit these vulnerabilities to execute remote code, which poses a significant risk to organizations using these SAP products. It is crucial for companies to apply these patches promptly to protect their systems from potential attacks. The vulnerabilities highlight the ongoing need for vigilance in software security, particularly for widely-used platforms like SAP.

Nov 10, 2026