{"vulnerability": "CVE-2026-105134", "sightings": [{"uuid": "3a6a5260-bf72-4a40-be72-96f48919f31f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105134", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117378933239812056", "content": "There is a new vulnerability with elevated criticality in Ahsay AhsayCBS (CVE-2026-105134) https://vuldb.com/vuln/413351", "creation_timestamp": "2026-10-03T20:46:23.154787Z"}, {"uuid": "a7951e9c-db34-429d-977a-f097d3a17afa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105134", "type": "seen", "source": "https://gist.github.com/ichintu/231f28d16cc1668438fdb199fb3943c7", "content": "This daily cyber threat intelligence briefing covers critical vulnerabilities, enforcement actions, emerging threats, and strategic guidance:\n\n- **Critical Vulnerabilities:** Two CVSS 10.0 flaws were disclosed: a code injection in InternLM MindSearch (CVE-2026-105135) and an OS command injection in Ahsay AhsayCBS (CVE-2026-105134), both actively exploited in the wild.\n- **Law Enforcement & Espionage:** The FBI detained suspected ShinyHunters extortionist \u201cRey\u201d in Jordan, who is now cooperating with investigators. Separately, China-aligned TA419 is targeting U.S. AI policy experts with Microsoft account takeover phishing campaigns.\n- **Post-Quantum Migration:** Experts urge SMBs to immediately map cryptographic assets and begin migration to counter \u201charvest now, decrypt later\u201d threats, citing finalized NIST PQC standards and cloud vendor roadmaps.\n- **Industry Discourse:** Security professionals highlight that superficially renaming threats or security practices cannot substitute for addressing underlying vulnerabilities and operational gaps.", "creation_timestamp": "2026-10-04T08:00:33.000000Z"}, {"uuid": "72c6ec05-c429-4873-92ee-add5f0a64048", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105134", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwzx26cith22", "content": "\ud83d\udea8 CVE-2026-105134 \u2014 CVSS 9.3 CRITICAL\n\nA flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-105134\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-10-04T08:07:05.861390Z"}, {"uuid": "2583ae6e-69a9-4817-8bf7-32dfb7cc75c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-105134", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117382173564078136", "content": "CVE-2026-105134 (CRITICAL): Ahsay AhsayCBS \u226410.3.2 suffers OS command injection in Replication Receiver (/rps/api/json/UpdateReceivers.do). Remote RCE possible \u2014 public exploit out. Patch to 10.3.4+ now. https://radar.offseq.com/threat/cve-2026-105134-os-command-injection-in-ahsay-ahsaycbs-a9df873cc55c0ce9 #OffSeq #Vuln #CVE #PatchNow", "creation_timestamp": "2026-10-04T10:30:26.879818Z"}, {"uuid": "67f61dce-820d-4efd-af3b-8be35e617595", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-105134", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mx272keqm52y", "content": "AhsayCBS 10.3.0 \u2013 10.3.2 hit by CRITICAL OS command injection (CVE-2026-105134). Remote code execution possible \u2014 exploit is public. Upgrade to 10.3.4+ immediately. https://radar.offseq.com/threat/cve-2026-105134-os-command-injection-in-ahsay-ahsaycbs-a9df873cc55c0ce9 #OffSeq #Vulnerability #CVE", "creation_timestamp": "2026-10-04T10:30:29.180561Z"}, {"uuid": "7b741ed7-599b-49cb-96a3-4953335134d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105134", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx2qyckmum2k", "content": "\ud83d\udd34 CVE-2026-105134 - Critical (10)\n\nA flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105134/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-10-04T15:51:20.864358Z"}, {"uuid": "4c6f3422-a919-4d15-85a9-05aec218f75f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-105134", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117386774626746380", "content": "AhsayCBS <10.3.4 hit by CRITICAL OS command injection (CVE-2026-105134) in Replication Receiver. Remote, unauthenticated exploitation = total system compromise. Upgrade to 10.3.4 ASAP. Exploit is public. https://radar.offseq.com/threat/a-flaw-has-been-found-in-ahsay-ahsaycbs-up-to-1032-cve-2026-105134-a9f0def985d0c48e #OffSeq #CVE2026105134 #Infosec #Vulnerability", "creation_timestamp": "2026-10-05T06:00:35.318953Z"}, {"uuid": "9a205106-847a-4461-96c9-514eece13090", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-105134", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mx4agumjuv2a", "content": "CRITICAL: AhsayCBS <10.3.4 vulnerable to unauthenticated OS command injection (CVE-2026-105134). Remote exploit = full compromise. Upgrade to 10.3.4 now. https://radar.offseq.com/threat/a-flaw-has-been-found-in-ahsay-ahsaycbs-up-to-1032-cve-2026-105134-a9f0def985d0c48e #OffSeq #Vulnerability #Ahs...", "creation_timestamp": "2026-10-05T06:00:35.341135Z"}, {"uuid": "e1e18de8-a43d-412e-a07c-4bca2ab77b44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105134", "type": "published-proof-of-concept", "source": "Telegram/zC7t4Lx05uyfmCVlTGAKrLAcTODowFQbx3kd_6HhY1YAH_E", "content": "", "creation_timestamp": "2026-10-05T15:00:22.000000Z"}, {"uuid": "61b575db-dd03-4cee-af4a-4b4a886e1ff0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105134", "type": "published-proof-of-concept", "source": "Telegram/GOrgALHLlGrhdYrogrKLZtBTzTEKx1k4RmUgAM1icRHlvtg", "content": "", "creation_timestamp": "2026-10-05T21:00:04.000000Z"}, {"uuid": "1456ba08-7013-47c5-86d3-b1b0face49d1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105134", "type": "seen", "source": "https://infosec.exchange/users/edwardk/statuses/117410136266256277", "content": "Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer\nThreat actors are exploiting critical AhsayCBS flaws, including CVE-2026-105133 and CVE-2026-105134, to deploy webshells and XMRig cryptominers, Huntress reports. Administrators are urged to update to version 10.3.4 and restrict access to exposed servers. https://www.huntress.com/blog/ahsaycbs-flaws-exploit", "creation_timestamp": "2026-10-09T09:01:43.618653Z"}, {"uuid": "08710068-acd5-4db3-b3b1-eb8ed3414c04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105134", "type": "seen", "source": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mxgmgialfc26", "content": "Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer\n\nThreat actors are exploiting critical AhsayCBS flaws, including CVE-2026-105133 and CVE-2026-105134, to deploy webshells and XMRig ... https://threatintel.cc/2026/10/09/threat-actors-exploit-critical-ahsaycbs.html", "creation_timestamp": "2026-10-09T09:01:44.984614Z"}, {"uuid": "ceedb9d1-a6f7-4be7-89ea-6515605cbe9a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105134", "type": "seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mxgyh5wo4t25", "content": "@huntress.com\nAttackers chain AhsayCBS flaws to deploy JSP webshells and XMRig.\n-\nIOCs: imagefiles-backup[.]oss-ap-southeast-7[.]aliyuncs[.]com, xmr[.]kryptex[.]network, 51[.]195[.]127[.]124\n-\n#CVE-2026-105134 #ThreatIntel #XMRig", "creation_timestamp": "2026-10-09T12:36:52.123123Z"}, {"uuid": "78ce6b62-5399-4ec0-bd44-73081e0f7be7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105134", "type": "exploited", "source": "https://t.me/information_security_channel/56078", "content": "Unpatched AhsayCBS Vulnerabilities Exploited in the Wild\nhttps://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/\n\nThe flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands.\nThe post Unpatched AhsayCBS Vulnerabilities Exploited in the Wild (https://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/) appeared first on SecurityWeek (https://www.securityweek.com/).", "creation_timestamp": "2026-10-09T10:48:08.000000Z"}, {"uuid": "c630fead-b9c9-42e5-8322-f46ddf89cf59", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105134", "type": "seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mxhlvh72r62d", "content": "AhsayCBS\u306e\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u3068OS\u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027(CVE-2026-105133\u3001CVE-2026-105134)\u304c\u3001\u30d1\u30c3\u30c1\u672a\u9069\u7528\u306e\u72b6\u614b\u3067\u653b\u6483\u306b\u5229\u7528\u3055\u308c\u3066\u3044\u308b\u3002", "creation_timestamp": "2026-10-09T18:24:52.520689Z"}, {"uuid": "c1e82a8e-8dcb-4b07-aff3-30dbd91355f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105134", "type": "seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mxi62jhkyv2o", "content": "AhsayCBS flaws CVE-2026-105133 and CVE-2026-105134 reportedly face exploitation. Restrict unnecessary access and check vendor guidance. The supplied report describes them as unpatched; no fixed build is given. https://cti.securitycyber.uk", "creation_timestamp": "2026-10-09T23:49:50.033805Z"}, {"uuid": "75b41480-2a09-49bf-9459-36d92478a359", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105134", "type": "exploited", "source": "https://t.me/VulnerabilityNews/44849", "content": "Unpatched AhsayCBS Vulnerabilities Exploited in the Wild\n\nThe flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands.\nThe post Unpatched AhsayCBS Vulnerabilities Exploited in the Wild appeared first on SecurityWeek.\nhttps://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/", "creation_timestamp": "2026-10-09T23:00:48.000000Z"}, {"uuid": "a70d3b25-b98a-4449-b120-fae09f9e7540", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105134", "type": "seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mxiwqpdjau2p", "content": "Same story, different day, as unpatched AhsayCBS flaws CVE-2026-105133 and CVE-2026-105134 get actively hammered in the wild. This calamity falls directly upon AhsayCBS administrators who dared to hope their backup servers might require actual logins. Defending ourselves against ...\n\nRead full story", "creation_timestamp": "2026-10-10T07:11:44.095713Z"}, {"uuid": "02696d9d-79c8-425a-b2ec-671daa7ad705", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105134", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ee51c36a-4e8a-4563-8754-ae5f29e4f74b", "content": "", "creation_timestamp": "2026-10-10T10:00:34.998209Z"}, {"uuid": "11e58ac6-942a-419b-a2e6-eed160721d1b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105134", "type": "seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mxjzgz3mbb2w", "content": "Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer\n\nThis article heavily focuses on post-exploitation and persistence techniques, yet it minimizes the potential systemic risk of an unauthenticated RCE via CVE-2026-105134 in a critical backup man\u2026\n\nvia Huntress Labs", "creation_timestamp": "2026-10-10T17:32:39.731718Z"}, {"uuid": "da290102-b8a8-404f-838c-7c241e283785", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105134", "type": "seen", "source": "https://t.me/pphm_HackerNews/3523", "content": "\ud83d\udd34 Unpatched AhsayCBS Vulnerabilities Exploited in the Wild\n\nHackers have been exploiting two unpatched vulnerabilities in the AhsayCBS backup solution for remote code execution (RCE), cybersecurity firm Huntress warns.\n\nA centralized cloud backup server management console developed by Ahsay Systems, AhsayCBS provides backup policy, storage, and user management and is popular among MSPs and system integrators.\n\nTracked as CVE-2026-105133 and CVE-2026-105134, the exploited security defects allow attackers to manipulate arguments in certain functions of the tool to bypass authentication and inject OS commands.", "creation_timestamp": "2026-10-09T19:42:04.000000Z"}, {"uuid": "39696b86-8904-4783-a260-a78b8a47a26a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105134", "type": "exploited", "source": "https://t.me/pphm_HackerNews/3523", "content": "\ud83d\udd34 Unpatched AhsayCBS Vulnerabilities Exploited in the Wild\n\nHackers have been exploiting two unpatched vulnerabilities in the AhsayCBS backup solution for remote code execution (RCE), cybersecurity firm Huntress warns.\n\nA centralized cloud backup server management console developed by Ahsay Systems, AhsayCBS provides backup policy, storage, and user management and is popular among MSPs and system integrators.\n\nTracked as CVE-2026-105133 and CVE-2026-105134, the exploited security defects allow attackers to manipulate arguments in certain functions of the tool to bypass authentication and inject OS commands.", "creation_timestamp": "2026-10-09T19:42:04.000000Z"}, {"uuid": "e6cab6ce-36fc-4f73-8ec9-f4d448212d81", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105134", "type": "seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mxkvpidryf2i", "content": "CVE-2026-105134 is trending. Hype score 5, currently #8 on cvemon.\n\nA flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver.\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-105134", "creation_timestamp": "2026-10-11T01:58:29.077350Z"}, {"uuid": "5cd5ba18-4fa1-461e-b9bc-9048e21974f8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105134", "type": "seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3mxlhqzwk632g", "content": "\ud83c\udf0d \u00c0 l\u2019international (4)\n\u2022 AhsayCBS : Deux vuln\u00e9rabilit\u00e9s dont une critique (CVE-2026-105133 et CVE-2026-105134) sont d\u00e9j\u00e0 exploit\u00e9es pour d\u00e9ployer des webshells et un mineur XMRig sur des serveurs de sauvegarde non corrig\u00e9s. (Forenshield)", "creation_timestamp": "2026-10-11T07:21:28.289983Z"}, {"uuid": "6c7c2d89-018c-487d-afd8-58744d570455", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-105134", "type": "seen", "source": "https://bsky.app/profile/suriq.io/post/3mxlndinvpm2x", "content": "\ud83d\udd34 EXPLOITED\n\nAhsayCBS backup servers are under active attack. Two chained flaws give code execution as SYSTEM on an exposed console, no login needed.\n\nThe latest version, 10.3.4, has no patch.\n\nFix: restrict the console to trusted IPs or VPN. (CVE-2026-105134)", "creation_timestamp": "2026-10-11T09:01:16.858897Z"}]}