[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-backup-software-flaws-let-hackers-mine-crypto-on-servers":10,"sections":40},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":30,"tags":31,"sources":35,"feedback":39,"feedback_at":22,"cost_usd":39,"total_tokens":39},11482,"backup-software-flaws-let-hackers-mine-crypto-on-servers","Backup Software Flaws Let Hackers Mine Crypto on Servers","A critical AhsayCBS bug let attackers skip login entirely and turn backup servers into Monero miners before patches and mitigations arrived.","Hackers found a way into the servers meant to save businesses from ransomware - and used it to mine Monero instead.\n\nSecurity firm Huntress disclosed two flaws in AhsayCBS, a server backup platform used by businesses and IT service providers, on October 4, 2026: CVE-2026-105113, a medium-severity authentication bypass in the checkSysPwd function, and CVE-2026-105134, a critical flaw in the Replication Receiver component that allows unauthenticated remote code execution as NT AUTHORITY\u002FSYSTEM. Three days later, attackers began chaining both bugs to drop JSP webshells and install the XMRig cryptominer, disguised as a Microsoft Edge update service, on exposed servers. All AhsayCBS versions through 10.3.4 are affected, patches are already available, and Huntress says at least five organizations had been hit by October 8. Admins are urged to update immediately, restrict the management interface to trusted IPs or a VPN, and fully re-image any compromised host, since attackers used the access to plant backdoors for longer-term persistence.\n\nBackups are the standard defense against ransomware, which makes a remotely exploitable hole in backup software especially unwelcome. This particular intrusion only installed a cryptominer - complete with an AI-written script that kills itself whenever Task Manager opens - but the same unauthenticated access could just as easily have delivered an encryptor instead.\n\nMining Monero on a hijacked server is a nuisance bill; the fact that the server in question was supposed to be the last line of defense is the actual headline.","[\"security\",\"ahsaycbs\",\"cryptojacking\",\"vulnerabilities\"]","2026-10-13T15:10:00.000Z","2026-10-13T16:14:47.136Z","2026-10-13T16:14:52.733Z","published",null,[24],{"id":25,"reviewer":26,"round":27,"reason":28,"status":29},"editor-r1","editor",1,"Add the concrete security specifics available in the source but missing from the draft — the CVE IDs, affected AhsayCBS versions (through 10.3.4), and the fact that patches\u002Fmitigations (network restriction, re-imaging if compromised) already exist, since readers running this software need to know whether and how to act.","resolved","security",[30,32,33,34],"ahsaycbs","cryptojacking","vulnerabilities",[36],{"name":37,"url":38},"TechRadar","https:\u002F\u002Fwww.techradar.com\u002Fpro\u002Fsecurity\u002Fhackers-turn-business-backup-servers-into-crypto-mines-after-sneaking-malware-disguised-as-microsoft-edge",0,{"sections":41},[42,47,51,56,60,65,70,75,80,85,90,95,100,105],{"name":43,"slug":44,"count":45,"latest_published_at":46},"AI","ai",7006,"2026-10-14T16:43:24.000Z",{"name":48,"slug":30,"count":49,"latest_published_at":50},"Security",989,"2026-10-14T16:47:39.000Z",{"name":52,"slug":53,"count":54,"latest_published_at":55},"Deals","deals",512,"2026-10-14T17:24:42.000Z",{"name":57,"slug":58,"count":54,"latest_published_at":59},"Policy","policy","2026-10-14T16:24:11.000Z",{"name":61,"slug":62,"count":63,"latest_published_at":64},"Hardware","hardware",256,"2026-10-14T16:03:09.000Z",{"name":66,"slug":67,"count":68,"latest_published_at":69},"Consumer Tech","consumer-tech",223,"2026-10-14T17:33:16.000Z",{"name":71,"slug":72,"count":73,"latest_published_at":74},"Science","science",201,"2026-10-13T23:13:31.000Z",{"name":76,"slug":77,"count":78,"latest_published_at":79},"Startups","startups",132,"2026-10-13T21:15:00.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":84},"Software","software",124,"2026-10-14T14:00:10.000Z",{"name":86,"slug":87,"count":88,"latest_published_at":89},"Dev Tools","dev-tools",116,"2026-10-13T16:20:18.000Z",{"name":91,"slug":92,"count":93,"latest_published_at":94},"General","general",78,"2026-10-14T14:55:47.000Z",{"name":96,"slug":97,"count":98,"latest_published_at":99},"Gaming","gaming",73,"2026-10-14T16:16:46.000Z",{"name":101,"slug":102,"count":103,"latest_published_at":104},"Reviews","reviews",37,"2026-10-14T10:00:00.000Z",{"name":106,"slug":107,"count":108,"latest_published_at":109},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]