Hackers found a way into the servers meant to save businesses from ransomware - and used it to mine Monero instead.
Security firm Huntress disclosed two flaws in AhsayCBS, a server backup platform used by businesses and IT service providers, on October 4, 2026: CVE-2026-105113, a medium-severity authentication bypass in the checkSysPwd function, and CVE-2026-105134, a critical flaw in the Replication Receiver component that allows unauthenticated remote code execution as NT AUTHORITY/SYSTEM. Three days later, attackers began chaining both bugs to drop JSP webshells and install the XMRig cryptominer, disguised as a Microsoft Edge update service, on exposed servers. All AhsayCBS versions through 10.3.4 are affected, patches are already available, and Huntress says at least five organizations had been hit by October 8. Admins are urged to update immediately, restrict the management interface to trusted IPs or a VPN, and fully re-image any compromised host, since attackers used the access to plant backdoors for longer-term persistence.
Backups are the standard defense against ransomware, which makes a remotely exploitable hole in backup software especially unwelcome. This particular intrusion only installed a cryptominer - complete with an AI-written script that kills itself whenever Task Manager opens - but the same unauthenticated access could just as easily have delivered an encryptor instead.
Mining Monero on a hijacked server is a nuisance bill; the fact that the server in question was supposed to be the last line of defense is the actual headline.