[Single source] Attacks exploit patched AhsayCBS flaws and deploy Python backdoor

Researchers have disclosed an October 2026 intrusion that they say chained two now-patched AhsayCBS vulnerabilities to bypass authentication, run arbitrary commands and install a Python-based implant. The clearest immediate response is to update exposed AhsayCBS systems and investigate them for signs of compromise.[1]Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoorthehackernews.com · rssOpen original sourceSee in source list

Huntress reportedly observed attackers exploiting CVE-2026-105133 and CVE-2026-105134 as a chain against AhsayCBS. According to the report, the flaws enabled an authentication bypass followed by arbitrary command execution on affected systems.[1]Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoorthehackernews.com · rssOpen original sourceSee in source list

A chain that removes the login barrier and then permits command execution can give an intruder substantial control of a backup server. That is especially concerning because backup infrastructure can hold sensitive data and play a central role in recovery, although the supplied evidence does not describe the consequences for any specific victim.[1]Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoorthehackernews.com · rssOpen original sourceSee in source list

Administrators should confirm that every AhsayCBS instance has received the fixes for both vulnerabilities, rather than addressing only one link in the reported chain. Systems that were exposed before patching should also be reviewed for unexpected command execution, Python payloads and other indicators associated with the reported activity.[1]Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoorthehackernews.com · rssOpen original sourceSee in source list[2]TheHackersNewsx.com · TheHackersNews · xOpen original sourceSee in source list

The supplied reporting identifies the two CVEs, the reported exploitation sequence and a Python implant. It does not establish how many organizations were affected, which threat actor was responsible, whether data was taken, or whether every reported payload appeared on every compromised system.[1]Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoorthehackernews.com · rssOpen original sourceSee in source list[2]TheHackersNewsx.com · TheHackersNews · xOpen original sourceSee in source list

The Hacker News summarized the intrusion as involving payloads concealed in PNG images, cryptocurrency miners and a Python backdoor designed to resist sandbox analysis. Its social post also said a related Veeam server received a credential query, but the supplied evidence does not independently verify that activity or explain the relationship between the servers.[2]TheHackersNewsx.com · TheHackersNews · xOpen original sourceSee in source list

Huntress reportedly observed the activity in October 2026. By the time details were published in November, both vulnerabilities were described as patched, shifting the immediate priority from waiting for a fix to deploying it and checking whether exposure had already led to compromise.[1]Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoorthehackernews.com · rssOpen original sourceSee in source list

1 independent groups, 2 updates, and 0 engagements.

The reported chain combines CVE-2026-105133 and CVE-2026-105134. In plain terms, the first stage allegedly lets an attacker get around authentication, while the chain ultimately enables commands of the attacker's choosing to run on the target. The follow-on tooling reportedly included a Python implant with sandbox-evasion behavior.[1]Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoorthehackernews.com · rssOpen original sourceSee in source list[2]TheHackersNewsx.com · TheHackersNews · xOpen original sourceSee in source list

The evidence consists of a Hacker News report summarizing Huntress's findings and a later social post from the same publisher. The two items are consistent, but they are not independent confirmations, and the supplied material does not include the Huntress research, vendor advisory, patch versions or primary forensic artifacts.[1]Attackers Exploit AhsayCBS Flaws to Deploy Sandbox-Evading Python Backdoorthehackernews.com · rssOpen original sourceSee in source list[2]TheHackersNewsx.com · TheHackersNews · xOpen original sourceSee in source list