Unpatched AhsayCBS Flaws Under Active Exploitation for Webshells and Cryptomining

What Happened

BleepingComputer reports that threat actors are actively exploiting two unpatched vulnerabilities in AhsayCBS, Ahsay's backup management platform — one rated critical and one medium-severity — to deploy webshells and cryptocurrency miners. Both flaws reportedly remain unpatched at the time of reporting.

Why It Matters

Backup management platforms like AhsayCBS typically hold privileged access to client systems and sensitive data across managed environments, making them an attractive foothold for attackers. Organizations and MSPs running AhsayCBS are at risk of unauthorized webshell access and resource-hijacking via cryptomining, and the lack of a patch means exposure persists until a fix is available.

What Defenders Should Watch For

• Inventory any AhsayCBS instances in your environment or your MSP's environment and assess internet exposure.
• Monitor AhsayCBS web-facing components for anomalous file writes, newly created scripts, or unexpected child processes spawned by the application — common indicators of webshell deployment.
• Watch for unusual CPU utilization spikes, unfamiliar scheduled tasks, or outbound connections to mining pools on hosts running AhsayCBS.
• Restrict network access to AhsayCBS management interfaces where possible and review authentication/access logs for suspicious activity.
• Follow Ahsay's advisories closely for patch availability and apply updates as soon as they are released.

Developing Situation

This is based on a single vendor-neutral news report and details may evolve as more information emerges, including whether official patches or advisories from Ahsay follow. We will update coverage as the picture develops. Read the original report from BleepingComputer: Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto.