{"metadata": {"vulnerability": "CVE-2026-105134", "count": 86, "kinds": {"milestone": 5, "sighting": 54, "kev": 11, "other": 16}}, "data": [{"timestamp": "2025-08-04T16:30:00Z", "date_only": false, "value": "2025-08-04T16:30:00Z", "kind": "other", "label": "Document generated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0427", "record": "NCSC-2026-0427", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-03T00:00:00Z", "date_only": false, "value": "2026-10-03T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / VulDB", "record": "CVE-2026-105134", "field": "containers.cna.timeline.0.time"}, {"timestamp": "2026-10-03T02:00:00Z", "date_only": false, "value": "2026-10-03T02:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / VulDB", "record": "CVE-2026-105134", "field": "containers.cna.timeline.1.time"}, {"timestamp": "2026-10-03T13:13:35.953Z", "date_only": false, "value": "2026-10-03T13:13:35.953Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-105134", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-03T20:46:23.154Z", "date_only": false, "value": "2026-10-03T20:46:23.154787Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/vuldb/statuses/117378933239812056", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "3a6a5260-bf72-4a40-be72-96f48919f31f", "content": "There is a new vulnerability with elevated criticality in Ahsay AhsayCBS (CVE-2026-105134) https://vuldb.com/vuln/413351", "url": "https://infosec.exchange/users/vuldb/statuses/117378933239812056"}, {"timestamp": "2026-10-04T05:30:12.882Z", "date_only": false, "value": "2026-10-04T05:30:12.882Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-105134", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-04T07:16:33Z", "date_only": false, "value": "2026-10-04T07:16:33Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-MXJ3-2X8Q-2RH9", "record": "GHSA-MXJ3-2X8Q-2RH9", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-04T07:16:33.480Z", "date_only": false, "value": "2026-10-04T07:16:33.480", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-105134", "record": "FKIE_CVE-2026-105134", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-04T08:00:33Z", "date_only": false, "value": "2026-10-04T08:00:33.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/ichintu/231f28d16cc1668438fdb199fb3943c7", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "a7951e9c-db34-429d-977a-f097d3a17afa", "content": "This daily cyber threat intelligence briefing covers critical vulnerabilities, enforcement actions, emerging threats, and strategic guidance:\n\n- **Critical Vulnerabilities:** Two CVSS 10.0 flaws were disclosed: a code injection in InternLM MindSearch (CVE-2026-105135) and an OS command injection in Ahsay AhsayCBS (CVE-2026-105134), both actively exploited in the wild.\n- **Law Enforcement & Espionage:** The FBI detained suspected ShinyHunters extortionist \u201cRey\u201d in Jordan, who is now cooperating with investigators. Separately, China-aligned TA419 is targeting U.S. AI policy experts with Microsoft account takeover phishing campaigns.\n- **Post-Quantum Migration:** Experts urge SMBs to immediately map cryptographic assets and begin migration to counter \u201charvest now, decrypt later\u201d threats, citing finalized NIST PQC standards and cloud vendor roadmaps.\n- **Industry Discourse:** Security professionals highlight that superficially renaming threats or security practices cannot substitute for addressing underlying vulnerabilities and operational gaps.", "url": "https://gist.github.com/ichintu/231f28d16cc1668438fdb199fb3943c7"}, {"timestamp": "2026-10-04T08:07:05.861Z", "date_only": false, "value": "2026-10-04T08:07:05.861390Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mwzx26cith22", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "72c6ec05-c429-4873-92ee-add5f0a64048", "content": "\ud83d\udea8 CVE-2026-105134 \u2014 CVSS 9.3 CRITICAL\n\nA flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-105134\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mwzx26cith22"}, {"timestamp": "2026-10-04T09:30:20Z", "date_only": false, "value": "2026-10-04T09:30:20Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-MXJ3-2X8Q-2RH9", "record": "GHSA-MXJ3-2X8Q-2RH9", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-04T10:30:26.879Z", "date_only": false, "value": "2026-10-04T10:30:26.879818Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117382173564078136", "record": "cve-2026-105134", "field": "creation_timestamp", "uuid": "2583ae6e-69a9-4817-8bf7-32dfb7cc75c9", "content": "CVE-2026-105134 (CRITICAL): Ahsay AhsayCBS \u226410.3.2 suffers OS command injection in Replication Receiver (/rps/api/json/UpdateReceivers.do). Remote RCE possible \u2014 public exploit out. Patch to 10.3.4+ now. https://radar.offseq.com/threat/cve-2026-105134-os-command-injection-in-ahsay-ahsaycbs-a9df873cc55c0ce9 #OffSeq #Vuln #CVE #PatchNow", "url": "https://infosec.exchange/users/offseq/statuses/117382173564078136"}, {"timestamp": "2026-10-04T10:30:29.180Z", "date_only": false, "value": "2026-10-04T10:30:29.180561Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mx272keqm52y", "record": "cve-2026-105134", "field": "creation_timestamp", "uuid": "67f61dce-820d-4efd-af3b-8be35e617595", "content": "AhsayCBS 10.3.0 \u2013 10.3.2 hit by CRITICAL OS command injection (CVE-2026-105134). Remote code execution possible \u2014 exploit is public. Upgrade to 10.3.4+ immediately. https://radar.offseq.com/threat/cve-2026-105134-os-command-injection-in-ahsay-ahsaycbs-a9df873cc55c0ce9 #OffSeq #Vulnerability #CVE", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mx272keqm52y"}, {"timestamp": "2026-10-04T15:51:20.864Z", "date_only": false, "value": "2026-10-04T15:51:20.864358Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx2qyckmum2k", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "7b741ed7-599b-49cb-96a3-4953335134d4", "content": "\ud83d\udd34 CVE-2026-105134 - Critical (10)\n\nA flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of ...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-105134/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mx2qyckmum2k"}, {"timestamp": "2026-10-05T06:00:35.318Z", "date_only": false, "value": "2026-10-05T06:00:35.318953Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117386774626746380", "record": "cve-2026-105134", "field": "creation_timestamp", "uuid": "4c6f3422-a919-4d15-85a9-05aec218f75f", "content": "AhsayCBS <10.3.4 hit by CRITICAL OS command injection (CVE-2026-105134) in Replication Receiver. Remote, unauthenticated exploitation = total system compromise. Upgrade to 10.3.4 ASAP. Exploit is public. https://radar.offseq.com/threat/a-flaw-has-been-found-in-ahsay-ahsaycbs-up-to-1032-cve-2026-105134-a9f0def985d0c48e #OffSeq #CVE2026105134 #Infosec #Vulnerability", "url": "https://infosec.exchange/users/offseq/statuses/117386774626746380"}, {"timestamp": "2026-10-05T06:00:35.341Z", "date_only": false, "value": "2026-10-05T06:00:35.341135Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mx4agumjuv2a", "record": "cve-2026-105134", "field": "creation_timestamp", "uuid": "9a205106-847a-4461-96c9-514eece13090", "content": "CRITICAL: AhsayCBS <10.3.4 vulnerable to unauthenticated OS command injection (CVE-2026-105134). Remote exploit = full compromise. Upgrade to 10.3.4 now. https://radar.offseq.com/threat/a-flaw-has-been-found-in-ahsay-ahsaycbs-up-to-1032-cve-2026-105134-a9f0def985d0c48e #OffSeq #Vulnerability #Ahs...", "url": "https://bsky.app/profile/offseq.bsky.social/post/3mx4agumjuv2a"}, {"timestamp": "2026-10-05T15:00:22Z", "date_only": false, "value": "2026-10-05T15:00:22.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/zC7t4Lx05uyfmCVlTGAKrLAcTODowFQbx3kd_6HhY1YAH_E", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "e1e18de8-a43d-412e-a07c-4bca2ab77b44", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-05T21:00:04Z", "date_only": false, "value": "2026-10-05T21:00:04.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/GOrgALHLlGrhdYrogrKLZtBTzTEKx1k4RmUgAM1icRHlvtg", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "61b575db-dd03-4cee-af4a-4b4a886e1ff0", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-09T09:01:43.618Z", "date_only": false, "value": "2026-10-09T09:01:43.618653Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117410136266256277", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "1456ba08-7013-47c5-86d3-b1b0face49d1", "content": "Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer\nThreat actors are exploiting critical AhsayCBS flaws, including CVE-2026-105133 and CVE-2026-105134, to deploy webshells and XMRig cryptominers, Huntress reports. Administrators are urged to update to version 10.3.4 and restrict access to exposed servers. https://www.huntress.com/blog/ahsaycbs-flaws-exploit", "url": "https://infosec.exchange/users/edwardk/statuses/117410136266256277"}, {"timestamp": "2026-10-09T09:01:44.984Z", "date_only": false, "value": "2026-10-09T09:01:44.984614Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mxgmgialfc26", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "08710068-acd5-4db3-b3b1-eb8ed3414c04", "content": "Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer\n\nThreat actors are exploiting critical AhsayCBS flaws, including CVE-2026-105133 and CVE-2026-105134, to deploy webshells and XMRig ... https://threatintel.cc/2026/10/09/threat-actors-exploit-critical-ahsaycbs.html", "url": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mxgmgialfc26"}, {"timestamp": "2026-10-09T09:54:00Z", "date_only": false, "value": "2026-10-09T09:54:00+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-105134", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "ee51c36a-4e8a-4563-8754-ae5f29e4f74b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-09T09:54:00Z", "date_only": false, "value": "2026-10-09T09:54:00+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-105134", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "ee51c36a-4e8a-4563-8754-ae5f29e4f74b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-09T09:54:00Z", "date_only": false, "value": "2026-10-09T09:54:00+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-105134", "field": "status.status_updated_at", "uuid": "ee51c36a-4e8a-4563-8754-ae5f29e4f74b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-09T09:54:00.860Z", "date_only": false, "value": "2026-10-09T09:54:00.860Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-105134", "field": "evidence.0.details.added_date", "uuid": "ee51c36a-4e8a-4563-8754-ae5f29e4f74b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-09T10:48:08Z", "date_only": false, "value": "2026-10-09T10:48:08.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/information_security_channel/56078", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "78ce6b62-5399-4ec0-bd44-73081e0f7be7", "content": "Unpatched AhsayCBS Vulnerabilities Exploited in the Wild\nhttps://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/\n\nThe flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands.\nThe post Unpatched AhsayCBS Vulnerabilities Exploited in the Wild (https://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/) appeared first on SecurityWeek (https://www.securityweek.com/).", "url": "https://t.me/information_security_channel/56078", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-09T12:36:52.123Z", "date_only": false, "value": "2026-10-09T12:36:52.123123Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3mxgyh5wo4t25", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "ceedb9d1-a6f7-4be7-89ea-6515605cbe9a", "content": "@huntress.com\nAttackers chain AhsayCBS flaws to deploy JSP webshells and XMRig.\n-\nIOCs: imagefiles-backup[.]oss-ap-southeast-7[.]aliyuncs[.]com, xmr[.]kryptex[.]network, 51[.]195[.]127[.]124\n-\n#CVE-2026-105134 #ThreatIntel #XMRig", "url": "https://bsky.app/profile/cyfar.ca/post/3mxgyh5wo4t25"}, {"timestamp": "2026-10-09T18:24:52.520Z", "date_only": false, "value": "2026-10-09T18:24:52.520689Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/postac001.bsky.social/post/3mxhlvh72r62d", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "c630fead-b9c9-42e5-8322-f46ddf89cf59", "content": "AhsayCBS\u306e\u8a8d\u8a3c\u30d0\u30a4\u30d1\u30b9\u3068OS\u30b3\u30de\u30f3\u30c9\u30a4\u30f3\u30b8\u30a7\u30af\u30b7\u30e7\u30f3\u306e\u8106\u5f31\u6027(CVE-2026-105133\u3001CVE-2026-105134)\u304c\u3001\u30d1\u30c3\u30c1\u672a\u9069\u7528\u306e\u72b6\u614b\u3067\u653b\u6483\u306b\u5229\u7528\u3055\u308c\u3066\u3044\u308b\u3002", "url": "https://bsky.app/profile/postac001.bsky.social/post/3mxhlvh72r62d"}, {"timestamp": "2026-10-09T19:42:04Z", "date_only": false, "value": "2026-10-09T19:42:04.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/pphm_HackerNews/3523", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "39696b86-8904-4783-a260-a78b8a47a26a", "content": "\ud83d\udd34 Unpatched AhsayCBS Vulnerabilities Exploited in the Wild\n\nHackers have been exploiting two unpatched vulnerabilities in the AhsayCBS backup solution for remote code execution (RCE), cybersecurity firm Huntress warns.\n\nA centralized cloud backup server management console developed by Ahsay Systems, AhsayCBS provides backup policy, storage, and user management and is popular among MSPs and system integrators.\n\nTracked as CVE-2026-105133 and CVE-2026-105134, the exploited security defects allow attackers to manipulate arguments in certain functions of the tool to bypass authentication and inject OS commands.", "url": "https://t.me/pphm_HackerNews/3523", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-09T19:42:04Z", "date_only": false, "value": "2026-10-09T19:42:04.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/pphm_HackerNews/3523", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "da290102-b8a8-404f-838c-7c241e283785", "content": "\ud83d\udd34 Unpatched AhsayCBS Vulnerabilities Exploited in the Wild\n\nHackers have been exploiting two unpatched vulnerabilities in the AhsayCBS backup solution for remote code execution (RCE), cybersecurity firm Huntress warns.\n\nA centralized cloud backup server management console developed by Ahsay Systems, AhsayCBS provides backup policy, storage, and user management and is popular among MSPs and system integrators.\n\nTracked as CVE-2026-105133 and CVE-2026-105134, the exploited security defects allow attackers to manipulate arguments in certain functions of the tool to bypass authentication and inject OS commands.", "url": "https://t.me/pphm_HackerNews/3523"}, {"timestamp": "2026-10-09T23:00:48Z", "date_only": false, "value": "2026-10-09T23:00:48.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/VulnerabilityNews/44849", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "75b41480-2a09-49bf-9459-36d92478a359", "content": "Unpatched AhsayCBS Vulnerabilities Exploited in the Wild\n\nThe flaws, CVE-2026-105133 and CVE-2026-105134, allow attackers to bypass authentication and inject OS commands.\nThe post Unpatched AhsayCBS Vulnerabilities Exploited in the Wild appeared first on SecurityWeek.\nhttps://www.securityweek.com/unpatched-ahsaycbs-vulnerabilities-exploited-in-the-wild/", "url": "https://t.me/VulnerabilityNews/44849", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-09T23:49:50.033Z", "date_only": false, "value": "2026-10-09T23:49:50.033805Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mxi62jhkyv2o", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "c1e82a8e-8dcb-4b07-aff3-30dbd91355f6", "content": "AhsayCBS flaws CVE-2026-105133 and CVE-2026-105134 reportedly face exploitation. Restrict unnecessary access and check vendor guidance. The supplied report describes them as unpatched; no fixed build is given. https://cti.securitycyber.uk", "url": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mxi62jhkyv2o"}, {"timestamp": "2026-10-10T07:11:44.095Z", "date_only": false, "value": "2026-10-10T07:11:44.095713Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cerberusit.bsky.social/post/3mxiwqpdjau2p", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "a70d3b25-b98a-4449-b120-fae09f9e7540", "content": "Same story, different day, as unpatched AhsayCBS flaws CVE-2026-105133 and CVE-2026-105134 get actively hammered in the wild. This calamity falls directly upon AhsayCBS administrators who dared to hope their backup servers might require actual logins. Defending ourselves against ...\n\nRead full story", "url": "https://bsky.app/profile/cerberusit.bsky.social/post/3mxiwqpdjau2p"}, {"timestamp": "2026-10-10T10:00:01Z", "date_only": false, "value": "2026-10-10T10:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-105134", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "ee51c36a-4e8a-4563-8754-ae5f29e4f74b", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-10T10:00:34.998Z", "date_only": false, "value": "2026-10-10T10:00:34.998209Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ee51c36a-4e8a-4563-8754-ae5f29e4f74b", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "02696d9d-79c8-425a-b2ec-671daa7ad705", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ee51c36a-4e8a-4563-8754-ae5f29e4f74b", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-10T17:32:39.731Z", "date_only": false, "value": "2026-10-10T17:32:39.731718Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/arc-codex.com/post/3mxjzgz3mbb2w", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "11e58ac6-942a-419b-a2e6-eed160721d1b", "content": "Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer\n\nThis article heavily focuses on post-exploitation and persistence techniques, yet it minimizes the potential systemic risk of an unauthenticated RCE via CVE-2026-105134 in a critical backup man\u2026\n\nvia Huntress Labs", "url": "https://bsky.app/profile/arc-codex.com/post/3mxjzgz3mbb2w"}, {"timestamp": "2026-10-11T01:58:29.077Z", "date_only": false, "value": "2026-10-11T01:58:29.077350Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvemon.bsky.social/post/3mxkvpidryf2i", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "e6cab6ce-36fc-4f73-8ec9-f4d448212d81", "content": "CVE-2026-105134 is trending. Hype score 5, currently #8 on cvemon.\n\nA flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver.\u2026\n\nhttps://cvemon.intruder.io/cves/CVE-2026-105134", "url": "https://bsky.app/profile/cvemon.bsky.social/post/3mxkvpidryf2i"}, {"timestamp": "2026-10-11T07:21:28.289Z", "date_only": false, "value": "2026-10-11T07:21:28.289983Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3mxlhqzwk632g", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "5cd5ba18-4fa1-461e-b9bc-9048e21974f8", "content": "\ud83c\udf0d \u00c0 l\u2019international (4)\n\u2022 AhsayCBS : Deux vuln\u00e9rabilit\u00e9s dont une critique (CVE-2026-105133 et CVE-2026-105134) sont d\u00e9j\u00e0 exploit\u00e9es pour d\u00e9ployer des webshells et un mineur XMRig sur des serveurs de sauvegarde non corrig\u00e9s. (Forenshield)", "url": "https://bsky.app/profile/cybowl.bsky.social/post/3mxlhqzwk632g"}, {"timestamp": "2026-10-11T09:01:16.858Z", "date_only": false, "value": "2026-10-11T09:01:16.858897Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/suriq.io/post/3mxlndinvpm2x", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "6c7c2d89-018c-487d-afd8-58744d570455", "content": "\ud83d\udd34 EXPLOITED\n\nAhsayCBS backup servers are under active attack. Two chained flaws give code execution as SYSTEM on an exposed console, no login needed.\n\nThe latest version, 10.3.4, has no patch.\n\nFix: restrict the console to trusted IPs or VPN. (CVE-2026-105134)", "url": "https://bsky.app/profile/suriq.io/post/3mxlndinvpm2x"}, {"timestamp": "2026-10-12T10:00:06Z", "date_only": false, "value": "2026-10-12T10:00:06.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/true_secator/8702", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "8e966ac9-140b-4c41-b2ff-ebdeeff22ba2", "content": "Huntress \u0437\u0430\u0434\u0435\u0442\u0435\u043a\u0442\u0438\u043b\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 CVE-2026-105133 \u0438 CVE-2026-105134 \u0432 \u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f AhsayCBS, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 RCE.\n\n\u041a\u043e\u043d\u0441\u043e\u043b\u044c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043e\u0431\u043b\u0430\u043a\u0435 AhsayCBS \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u043c\u0438 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435\u043c \u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0438 \u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0441\u0442\u044c\u044e \u0441\u0440\u0435\u0434\u0438 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u0432 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0443\u0441\u043b\u0443\u0433 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0442\u043e\u0440\u043e\u0432.\n\n\u0423\u043f\u043e\u043c\u044f\u043d\u0443\u0442\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438 \u0432 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0431\u044b\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b 4 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 AhsayCBS \u0434\u043e 10.3.2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u0412 \u043f\u0440\u043e\u0448\u043b\u044b\u0439 \u0447\u0435\u0442\u0432\u0435\u0440\u0433 Huntress \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u0432\u0435\u0440\u0441\u0438\u044f AhsayCBS, 10.3.4, \u0442\u0430\u043a\u0436\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u0430.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u0434\u043e \u0432\u044b\u0445\u043e\u0434\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u0432 \u0432\u0437\u043b\u043e\u043c\u0430.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Huntress, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u044e\u0442 \u043e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a \u043d\u0430 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445. \u041f\u043e \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044e \u043d\u0430 8 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0430\u0442\u0430\u043a\u0430\u043c \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u043b\u0438\u0441\u044c \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u043f\u044f\u0442\u044c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u043e, \u0447\u0442\u043e CVE-2026-105134 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0447\u0435\u0440\u0435\u0437 API \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 Replication Receiver.\n\nAPI \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0439 \u0442\u043e\u043a\u0435\u043d \u0432\u043c\u0435\u0441\u0442\u043e \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \n\n\u041a\u0430\u043a \u043f\u043e\u044f\u0441\u043d\u0438\u043b\u0430 Huntress, \u043f\u043e\u0441\u043b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u043b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043f\u0440\u0438\u0435\u043c\u043d\u0438\u043a \u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u043b \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 Java Server Page (JSP) \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c CBS.\n\n\u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u043e\u0432\u0435\u043b\u0438 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0443 \u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u043b\u0438 XMRig, \u0437\u0430\u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u0434 Microsoft Edge. \u041e\u043d\u0438 \u0442\u0430\u043a\u0436\u0435 \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0438 \u0441\u043a\u0440\u0438\u043f\u0442 PowerShell \u0441 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 \u0418\u0418 \u0434\u043b\u044f \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0430 \u0437\u0430\u0434\u0430\u0447 \u0438 \u0435\u0433\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f, \u0435\u0441\u043b\u0438 \u043e\u043d \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0441\u043b\u0438\u0448\u043a\u043e\u043c \u0434\u043e\u043b\u0433\u043e.\n\n\u041e\u043d\u0438 \u0442\u0430\u043a\u0436\u0435 \u0434\u043e\u0431\u0438\u043b\u0438\u0441\u044c \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u043e\u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0441\u043e\u0437\u0434\u0430\u0432 \u0441\u043b\u0443\u0436\u0431\u0443 Windows, \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u044e\u0449\u0443\u044e\u0441\u044f \u043f\u043e\u0434 Microsoft Edge Update, \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043a\u043e\u043f\u0438\u0438 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0439 \u0443\u0442\u0438\u043b\u0438\u0442\u044b NSSM \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c msedge.exe \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438.\n\nNSSM \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u0443 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044f \u0438\u0445 \u0431\u0435\u0441\u043f\u0435\u0440\u0435\u0431\u043e\u0439\u043d\u0443\u044e \u0440\u0430\u0431\u043e\u0442\u0443 \u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u043a \u043f\u043e\u0441\u043b\u0435 \u0441\u0431\u043e\u044f \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438, \u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432 \u044d\u0442\u043e\u043c \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0435\u0433\u043e \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f edge.exe, \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u044f \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0439 \u0441\u043e \u0441\u043b\u0443\u0436\u0431\u043e\u0439 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b \u043f\u043e\u0434 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439.\n\n\u0412 \u0445\u043e\u0434\u0435 \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0430\u0442\u0430\u043a \u0445\u0430\u043a\u0435\u0440\u044b \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u043b\u0438 WinRing0x64.sys, \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439, \u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u044f\u0434\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b \u043c\u0430\u0439\u043d\u0435\u0440\u0443 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430.\n\n\u0422\u0430\u043a \u0447\u0442\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f AhsayCBS, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0438\u0441 \u043d\u0430 \u0445\u043e\u0441\u0442\u0435. \u0414\u043e\u0441\u0442\u0443\u043f \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u043c\u0438 IP \u0438\u043b\u0438 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f VPN.", "url": "https://t.me/true_secator/8702", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-13T02:01:46.252Z", "date_only": false, "value": "2026-10-13T02:01:46.252313Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mxpwt47a722x", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "638c043b-51fc-4f0f-9212-ac26c93f0c9e", "content": "\u30d0\u30c3\u30af\u30a2\u30c3\u30d7\u7ba1\u7406\u88fd\u54c1 AhsayCBS\u306e\u8106\u5f31\u6027(CVE-2026-105133\u3001CVE-2026-105134)\u304c\u5b9f\u969b\u306e\u30b5\u30a4\u30d0\u30fc\u653b\u6483\u306b\u60aa\u7528\u2015Web\u30b7\u30a7\u30eb\u8a2d\u7f6e\u30fb\u4eee\u60f3\u901a\u8ca8\u30de\u30a4\u30cb\u30f3\u30b0\u3092\u78ba\u8a8d \n rocket-boys.co.jp/security-mea... \n\n#\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u5bfe\u7b56Lab #security #securitynews #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3 #\u30bb\u30ad\u30e5\u30ea\u30c6\u30a3\u30cb\u30e5\u30fc\u30b9", "url": "https://bsky.app/profile/securitylab-jp.bsky.social/post/3mxpwt47a722x"}, {"timestamp": "2026-10-13T10:51:10Z", "date_only": false, "value": "2026-10-13T10:51:10.000000Z", "kind": "sighting", "label": "Exploited", "source": "https://t.me/S_E_Reborn/6675", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "8ca63690-dac0-41b7-962d-3192fd452df8", "content": "Huntress \u0437\u0430\u0434\u0435\u0442\u0435\u043a\u0442\u0438\u043b\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 CVE-2026-105133 \u0438 CVE-2026-105134 \u0432 \u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f AhsayCBS, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 RCE.\n\n\u041a\u043e\u043d\u0441\u043e\u043b\u044c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043e\u0431\u043b\u0430\u043a\u0435 AhsayCBS \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u043c\u0438 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435\u043c \u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0438 \u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0441\u0442\u044c\u044e \u0441\u0440\u0435\u0434\u0438 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u0432 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0443\u0441\u043b\u0443\u0433 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0442\u043e\u0440\u043e\u0432.\n\n\u0423\u043f\u043e\u043c\u044f\u043d\u0443\u0442\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438 \u0432 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0431\u044b\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b 4 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 AhsayCBS \u0434\u043e 10.3.2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u0412 \u043f\u0440\u043e\u0448\u043b\u044b\u0439 \u0447\u0435\u0442\u0432\u0435\u0440\u0433 Huntress \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u0432\u0435\u0440\u0441\u0438\u044f AhsayCBS, 10.3.4, \u0442\u0430\u043a\u0436\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u0430.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u0434\u043e \u0432\u044b\u0445\u043e\u0434\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u0432 \u0432\u0437\u043b\u043e\u043c\u0430.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Huntress, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u044e\u0442 \u043e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a \u043d\u0430 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445. \u041f\u043e \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044e \u043d\u0430 8 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0430\u0442\u0430\u043a\u0430\u043c \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u043b\u0438\u0441\u044c \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u043f\u044f\u0442\u044c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u043e, \u0447\u0442\u043e CVE-2026-105134 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0447\u0435\u0440\u0435\u0437 API \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 Replication Receiver.\n\nAPI \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0439 \u0442\u043e\u043a\u0435\u043d \u0432\u043c\u0435\u0441\u0442\u043e \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \n\n\u041a\u0430\u043a \u043f\u043e\u044f\u0441\u043d\u0438\u043b\u0430 Huntress, \u043f\u043e\u0441\u043b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u043b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043f\u0440\u0438\u0435\u043c\u043d\u0438\u043a \u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u043b \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 Java Server Page (JSP) \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c CBS.\n\n\u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u043e\u0432\u0435\u043b\u0438 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0443 \u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u043b\u0438 XMRig, \u0437\u0430\u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u0434 Microsoft Edge. \u041e\u043d\u0438 \u0442\u0430\u043a\u0436\u0435 \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0438 \u0441\u043a\u0440\u0438\u043f\u0442 PowerShell \u0441 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 \u0418\u0418 \u0434\u043b\u044f \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0430 \u0437\u0430\u0434\u0430\u0447 \u0438 \u0435\u0433\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f, \u0435\u0441\u043b\u0438 \u043e\u043d \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0441\u043b\u0438\u0448\u043a\u043e\u043c \u0434\u043e\u043b\u0433\u043e.\n\n\u041e\u043d\u0438 \u0442\u0430\u043a\u0436\u0435 \u0434\u043e\u0431\u0438\u043b\u0438\u0441\u044c \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u043e\u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0441\u043e\u0437\u0434\u0430\u0432 \u0441\u043b\u0443\u0436\u0431\u0443 Windows, \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u044e\u0449\u0443\u044e\u0441\u044f \u043f\u043e\u0434 Microsoft Edge Update, \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043a\u043e\u043f\u0438\u0438 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0439 \u0443\u0442\u0438\u043b\u0438\u0442\u044b NSSM \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c msedge.exe \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438.\n\nNSSM \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u0443 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044f \u0438\u0445 \u0431\u0435\u0441\u043f\u0435\u0440\u0435\u0431\u043e\u0439\u043d\u0443\u044e \u0440\u0430\u0431\u043e\u0442\u0443 \u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u043a \u043f\u043e\u0441\u043b\u0435 \u0441\u0431\u043e\u044f \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438, \u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432 \u044d\u0442\u043e\u043c \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0435\u0433\u043e \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f edge.exe, \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u044f \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0439 \u0441\u043e \u0441\u043b\u0443\u0436\u0431\u043e\u0439 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b \u043f\u043e\u0434 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439.\n\n\u0412 \u0445\u043e\u0434\u0435 \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0430\u0442\u0430\u043a \u0445\u0430\u043a\u0435\u0440\u044b \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u043b\u0438 WinRing0x64.sys, \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439, \u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u044f\u0434\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b \u043c\u0430\u0439\u043d\u0435\u0440\u0443 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430.\n\n\u0422\u0430\u043a \u0447\u0442\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f AhsayCBS, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0438\u0441 \u043d\u0430 \u0445\u043e\u0441\u0442\u0435. \u0414\u043e\u0441\u0442\u0443\u043f \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u043c\u0438 IP \u0438\u043b\u0438 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f VPN.", "url": "https://t.me/S_E_Reborn/6675", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-13T10:51:10Z", "date_only": false, "value": "2026-10-13T10:51:10.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/S_E_Reborn/6675", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "b5dff17b-248b-4d88-9b0f-821fdc4d9108", "content": "Huntress \u0437\u0430\u0434\u0435\u0442\u0435\u043a\u0442\u0438\u043b\u0430 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435 \u043d\u0435\u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0445 CVE-2026-105133 \u0438 CVE-2026-105134 \u0432 \u0440\u0435\u0448\u0435\u043d\u0438\u0438 \u0434\u043b\u044f \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f AhsayCBS, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043e\u0431\u0445\u043e\u0434\u0438\u0442\u044c \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 RCE.\n\n\u041a\u043e\u043d\u0441\u043e\u043b\u044c \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432 \u043e\u0431\u043b\u0430\u043a\u0435 AhsayCBS \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u0438 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u043c\u0438 \u0440\u0435\u0437\u0435\u0440\u0432\u043d\u043e\u0433\u043e \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f, \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435\u043c \u0438 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f\u043c\u0438 \u0438 \u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u043f\u043e\u043f\u0443\u043b\u044f\u0440\u043d\u043e\u0441\u0442\u044c\u044e \u0441\u0440\u0435\u0434\u0438 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u0432 \u0443\u043f\u0440\u0430\u0432\u043b\u044f\u0435\u043c\u044b\u0445 \u0443\u0441\u043b\u0443\u0433 \u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u0445 \u0438\u043d\u0442\u0435\u0433\u0440\u0430\u0442\u043e\u0440\u043e\u0432.\n\n\u0423\u043f\u043e\u043c\u044f\u043d\u0443\u0442\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043c\u0430\u043d\u0438\u043f\u0443\u043b\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0438 \u0432 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u044f\u0445 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430, \u0447\u0442\u043e\u0431\u044b \u043e\u0431\u043e\u0439\u0442\u0438 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u044e \u0438 \u0432\u043d\u0435\u0434\u0440\u0438\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u044b.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0431\u044b\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b 4 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0438 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0442 \u0432\u0441\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 AhsayCBS \u0434\u043e 10.3.2 \u0432\u043a\u043b\u044e\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e. \u0412 \u043f\u0440\u043e\u0448\u043b\u044b\u0439 \u0447\u0435\u0442\u0432\u0435\u0440\u0433 Huntress \u043f\u0440\u0435\u0434\u0443\u043f\u0440\u0435\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0443\u0436\u0435 \u043d\u0430\u0447\u0430\u043b\u0438 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0432 \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445. \u041f\u0440\u0438 \u044d\u0442\u043e\u043c \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u044f\u044f \u0432\u0435\u0440\u0441\u0438\u044f AhsayCBS, 10.3.4, \u0442\u0430\u043a\u0436\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u0430.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u0434\u043e \u0432\u044b\u0445\u043e\u0434\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043f\u0440\u0438\u0437\u043d\u0430\u043a\u043e\u0432 \u0432\u0437\u043b\u043e\u043c\u0430.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Huntress, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043e\u0431\u044a\u0435\u0434\u0438\u043d\u044f\u044e\u0442 \u043e\u0431\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u043f\u043e\u043b\u0443\u0447\u0435\u043d\u0438\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u043c\u0443 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044e \u043a\u043e\u0434\u0430 \u0431\u0435\u0437 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u043d\u0438\u044f \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u0435\u043a \u043d\u0430 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445. \u041f\u043e \u0441\u043e\u0441\u0442\u043e\u044f\u043d\u0438\u044e \u043d\u0430 8 \u043e\u043a\u0442\u044f\u0431\u0440\u044f \u0430\u0442\u0430\u043a\u0430\u043c \u043f\u043e\u0434\u0432\u0435\u0440\u0433\u043b\u0438\u0441\u044c \u043a\u0430\u043a \u043c\u0438\u043d\u0438\u043c\u0443\u043c \u043f\u044f\u0442\u044c \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0439.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u043e\u0442\u043c\u0435\u0447\u0435\u043d\u043e, \u0447\u0442\u043e CVE-2026-105134 \u043c\u043e\u0436\u0435\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0430 \u0434\u043b\u044f \u043d\u0435\u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u044b\u0445 \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0447\u0435\u0440\u0435\u0437 API \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u0430 Replication Receiver.\n\nAPI \u0441\u043e\u0434\u0435\u0440\u0436\u0438\u0442 \u043c\u0435\u0445\u0430\u043d\u0438\u0437\u043c \u043e\u0431\u0445\u043e\u0434\u0430 \u0430\u0443\u0442\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0441\u043b\u0443\u0447\u0430\u0439\u043d\u044b\u0439 \u0442\u043e\u043a\u0435\u043d \u0432\u043c\u0435\u0441\u0442\u043e \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445. \n\n\u041a\u0430\u043a \u043f\u043e\u044f\u0441\u043d\u0438\u043b\u0430 Huntress, \u043f\u043e\u0441\u043b\u0435 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043d\u0430\u0441\u0442\u0440\u0430\u0438\u0432\u0430\u043b \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0439 \u043f\u0440\u0438\u0435\u043c\u043d\u0438\u043a \u0438 \u0440\u0430\u0437\u043c\u0435\u0449\u0430\u043b \u0432\u0435\u0431-\u043e\u0431\u043e\u043b\u043e\u0447\u043a\u0443 Java Server Page (JSP) \u0432 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u043e\u0431\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u0435\u043c\u043e\u0433\u043e \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435\u043c CBS.\n\n\u041f\u043e\u043b\u0443\u0447\u0438\u0432 \u043f\u0435\u0440\u0432\u043e\u043d\u0430\u0447\u0430\u043b\u044c\u043d\u044b\u0439 \u0434\u043e\u0441\u0442\u0443\u043f, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u043f\u0440\u043e\u0432\u0435\u043b\u0438 \u0440\u0430\u0437\u0432\u0435\u0434\u043a\u0443 \u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u043b\u0438 XMRig, \u0437\u0430\u043c\u0430\u0441\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043f\u043e\u0434 Microsoft Edge. \u041e\u043d\u0438 \u0442\u0430\u043a\u0436\u0435 \u0432\u043d\u0435\u0434\u0440\u0438\u043b\u0438 \u0441\u043a\u0440\u0438\u043f\u0442 PowerShell \u0441 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u043a\u043e\u0439 \u0418\u0418 \u0434\u043b\u044f \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u0434\u0438\u0441\u043f\u0435\u0442\u0447\u0435\u0440\u0430 \u0437\u0430\u0434\u0430\u0447 \u0438 \u0435\u0433\u043e \u0437\u0430\u0432\u0435\u0440\u0448\u0435\u043d\u0438\u044f, \u0435\u0441\u043b\u0438 \u043e\u043d \u043e\u0441\u0442\u0430\u0435\u0442\u0441\u044f \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u043c \u0441\u043b\u0438\u0448\u043a\u043e\u043c \u0434\u043e\u043b\u0433\u043e.\n\n\u041e\u043d\u0438 \u0442\u0430\u043a\u0436\u0435 \u0434\u043e\u0431\u0438\u043b\u0438\u0441\u044c \u0441\u043e\u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0440\u0430\u0431\u043e\u0442\u043e\u0441\u043f\u043e\u0441\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b, \u0441\u043e\u0437\u0434\u0430\u0432 \u0441\u043b\u0443\u0436\u0431\u0443 Windows, \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u044e\u0449\u0443\u044e\u0441\u044f \u043f\u043e\u0434 Microsoft Edge Update, \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043a\u043e\u043f\u0438\u0438 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u043e\u0439 \u0443\u0442\u0438\u043b\u0438\u0442\u044b NSSM \u043f\u043e\u0434 \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435\u043c msedge.exe \u0441 \u0441\u0438\u0441\u0442\u0435\u043c\u043d\u044b\u043c\u0438 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438.\n\nNSSM \u0441\u043f\u043e\u0441\u043e\u0431\u043d\u0430 \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0442\u044c \u0440\u0430\u0431\u043e\u0442\u0443 \u0434\u0440\u0443\u0433\u0438\u0445 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044f \u0438\u0445 \u0431\u0435\u0441\u043f\u0435\u0440\u0435\u0431\u043e\u0439\u043d\u0443\u044e \u0440\u0430\u0431\u043e\u0442\u0443 \u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0443\u0441\u043a \u043f\u043e\u0441\u043b\u0435 \u0441\u0431\u043e\u044f \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438, \u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0438 \u0432 \u044d\u0442\u043e\u043c \u0438\u043d\u0446\u0438\u0434\u0435\u043d\u0442\u0435, \u0432\u0435\u0440\u043e\u044f\u0442\u043d\u043e, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438 \u0435\u0433\u043e \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u043f\u043e\u0441\u0442\u043e\u044f\u043d\u043d\u043e\u0433\u043e \u043f\u0440\u0438\u0441\u0443\u0442\u0441\u0442\u0432\u0438\u044f edge.exe, \u043c\u0430\u0441\u043a\u0438\u0440\u0443\u044f \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0439 \u0441\u043e \u0441\u043b\u0443\u0436\u0431\u043e\u0439 \u0438\u0441\u043f\u043e\u043b\u043d\u044f\u0435\u043c\u044b\u0439 \u0444\u0430\u0439\u043b \u043f\u043e\u0434 \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439.\n\n\u0412 \u0445\u043e\u0434\u0435 \u043e\u0434\u043d\u043e\u0439 \u0438\u0437 \u0430\u0442\u0430\u043a \u0445\u0430\u043a\u0435\u0440\u044b \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u043b\u0438 WinRing0x64.sys, \u043b\u0435\u0433\u0438\u0442\u0438\u043c\u043d\u044b\u0439, \u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0439 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u044f\u0434\u0440\u0430, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u043b \u043c\u0430\u0439\u043d\u0435\u0440\u0443 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u044b \u0440\u0430\u0431\u043e\u0442\u0430\u0442\u044c \u0441 \u0434\u043e\u0441\u0442\u0443\u043f\u043e\u043c \u043d\u0430 \u0443\u0440\u043e\u0432\u043d\u0435 \u044f\u0434\u0440\u0430.\n\n\u0422\u0430\u043a \u0447\u0442\u043e \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f\u043c \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0432\u0435\u0431-\u0438\u043d\u0442\u0435\u0440\u0444\u0435\u0439\u0441\u0443 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f AhsayCBS, \u043f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043d\u0430\u0446\u0435\u043b\u0435\u043d\u0430 \u043d\u0430 \u0432\u043d\u0435\u0448\u043d\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 \u0432\u0435\u0431-\u0441\u0435\u0440\u0432\u0438\u0441 \u043d\u0430 \u0445\u043e\u0441\u0442\u0435. \u0414\u043e\u0441\u0442\u0443\u043f \u0434\u043e\u043b\u0436\u0435\u043d \u0431\u044b\u0442\u044c \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d \u0442\u043e\u043b\u044c\u043a\u043e \u0434\u043e\u0432\u0435\u0440\u0435\u043d\u043d\u044b\u043c\u0438 IP \u0438\u043b\u0438 \u0442\u0440\u0435\u0431\u043e\u0432\u0430\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f VPN.", "url": "https://t.me/S_E_Reborn/6675"}, {"timestamp": "2026-10-13T15:50:33.617Z", "date_only": false, "value": "2026-10-13T15:50:33.617405Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityrss.bsky.social/post/3mxrf56ki532j", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "442a51bd-1d63-44d5-aaa4-356bcd2d1d02", "content": "Attackers are exploiting two vulnerabilities in AhsayCBS (CVE-2026-105133 and CVE-2026-105134) to gain control of devices and deploy XMRig cryptocurrency miners disguised as Microsoft Edge. Exploitation began on October 7, 2026, affecting at least five organizations.", "url": "https://bsky.app/profile/securityrss.bsky.social/post/3mxrf56ki532j"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-105134", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "5372a69c-88fe-4cff-b4f5-28de9b6c5f58", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": true, "value": "2026-10-14", "kind": "other", "label": "Catalog added", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-105134", "field": "containers.adp.0.metrics.1.other.content.dateAdded"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": true, "value": "2026-10-14", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-105134", "field": "evidence.0.details.date_added", "uuid": "5372a69c-88fe-4cff-b4f5-28de9b6c5f58", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-105134", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "5372a69c-88fe-4cff-b4f5-28de9b6c5f58", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-105134", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-105134", "record": "FKIE_CVE-2026-105134", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-105134", "field": "status.status_updated_at", "uuid": "5372a69c-88fe-4cff-b4f5-28de9b6c5f58", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-105134", "field": "containers.adp.0.timeline.0.time"}, {"timestamp": "2026-10-14T05:00:00Z", "date_only": false, "value": "2026-10-14T05:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "16662cfc-57db-483c-82c0-29baac323dcb", "url": "https://www.cisa.gov/news-events/alerts/2026/10/14/cisa-adds-four-known-exploited-vulnerabilities-catalog"}, {"timestamp": "2026-10-14T06:19:14Z", "date_only": false, "value": "2026-10-14T06:19:14.000000Z", "kind": "sighting", "label": "Seen", "source": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0427", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "a3847044-03e0-44ee-a340-31676addfd3c", "url": "https://advisories.ncsc.nl/advisory?id=NCSC-2026-0427"}, {"timestamp": "2026-10-14T13:19:14.402Z", "date_only": false, "value": "2026-10-14T13:19:14.402156Z", "kind": "other", "label": "Advisory revision", "source": "csaf_ncscnl \u00b7 NCSC-2026-0427", "record": "NCSC-2026-0427", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-14T13:19:14.402Z", "date_only": false, "value": "2026-10-14T13:19:14.402156Z", "kind": "milestone", "label": "Published", "source": "csaf_ncscnl \u00b7 NCSC-2026-0427", "record": "NCSC-2026-0427", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-14T13:19:14.402Z", "date_only": false, "value": "2026-10-14T13:19:14.402156Z", "kind": "other", "label": "Updated", "source": "csaf_ncscnl \u00b7 NCSC-2026-0427", "record": "NCSC-2026-0427", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-14T17:00:09Z", "date_only": false, "value": "2026-10-14T17:00:09.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/105311", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "3013892d-0d87-4fb7-bd51-da2aee40b1c8", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #Exploit #RCE\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a AhsayCBS-Auth-Bypass-RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a horizon3ai\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Python\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-14 16:50:47\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nA proof of concept exploit for CVE-2026-105133 and CVE-2026-105134 affecting AhsayCBS\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/105311", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-14T18:41:11Z", "date_only": false, "value": "2026-10-14T18:41:11.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/P0x3k_1N73LL1G3NC3/446", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "4b152518-2a85-4ed0-b43b-e29a61757f1f", "content": "AhsayCBS-Auth-Bypass-RCE\n\nAhsayCBS versions 10.3.4 and earlier are vulnerable to unauthenticated remote code execution via two chained authentication bypass and path traversal flaws in the JSON API and replication receiver modules (CVE-2026-105133 and CVE-2026-105134). An attacker can achieve full administrative control or direct RCE without credentials.\n\nBlog: https://horizon3.ai/attack-research/attack-blogs/ahsaycbs-cve-2026-105133-cve-2026-105134-technical-analysis/", "url": "https://t.me/P0x3k_1N73LL1G3NC3/446", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-14T19:57:32.210Z", "date_only": false, "value": "2026-10-14T19:57:32.210172Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mxudfqmu7d2n", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "7728ee8e-7c27-4f87-99db-af84b7881262", "content": "\ud83d\uded1 CVE-2026-105134\nAhsay AhsayCBS\nCVSS 9.3 / EPSS 2% / KEV: No\nTL;DR: A flaw has been found in Ahsay AhsayCBS up to 10.3.2. This vulnerability affects unknown c\u2026\nhttps://cvesentinel.com/report/CVE-2026-105134?utm_source=bluesky&utm_medium=social&utm_campaign=cvesentinel\n#infosec #CVE #vulnerability", "url": "https://bsky.app/profile/cvesentinel.bsky.social/post/3mxudfqmu7d2n"}, {"timestamp": "2026-10-14T20:00:02Z", "date_only": false, "value": "2026-10-14T20:00:02+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-105134", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "5372a69c-88fe-4cff-b4f5-28de9b6c5f58", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-14T20:00:02.652Z", "date_only": false, "value": "2026-10-14T20:00:02.652160Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/5372a69c-88fe-4cff-b4f5-28de9b6c5f58", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "02bfd9eb-8e6b-47a3-9215-cc3344b47dd6", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/5372a69c-88fe-4cff-b4f5-28de9b6c5f58", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-14T21:05:37.599Z", "date_only": false, "value": "2026-10-14T21:05:37.599233Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mxuh7hcchr2u", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "80bd32e1-98f2-4760-86e7-621777088442", "content": "(CISA CS-MAN) The Cyber Mind CSUITE Brief: CVE-2026-105133 and CVE-2026-105134- AhsayCBS Security Brief: Protect the Systems Your Recovery Depends\u00a0On\n\nExecutive briefing on AhsayCBS vulnerabilities CVE-2026-105133 and CVE-2026-105134, covering incomplete patch\u2026\n\nhttps://thecybermind.co/mcs0", "url": "https://bsky.app/profile/thecybermind.co/post/3mxuh7hcchr2u"}, {"timestamp": "2026-10-14T21:20:04.186Z", "date_only": false, "value": "2026-10-14T21:20:04.186160Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aipostdaily.bsky.social/post/3mxuhzbtn4327", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "5abbf182-01d6-4a07-acae-4d50b8054073", "content": "CISA added CVE-2026-105134 to its Known Exploited Vulnerabilities list (2026-10-14).\nAhsay AhsayCBS Command Injection\nEPSS today: 0.018 (no score 30 days earlier)\n#infosec #KEV", "url": "https://bsky.app/profile/aipostdaily.bsky.social/post/3mxuhzbtn4327"}, {"timestamp": "2026-10-14T22:15:04.685Z", "date_only": false, "value": "2026-10-14T22:15:04.685269Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3mxul3npzr72x", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "b4f1ad35-7ede-4d5d-8dee-6dc66941dfb4", "content": "\ud83d\udea8 NEW on CISA KEV \u2014 exploited in the wild\nAhsay AhsayCBS: Ahsay AhsayCBS Command Injection Vulnerability\nCVE-2026-105134 \u00b7 patch by 2026-10-17\n\ud83d\udd17 https://ninjasignal.ninja/intel/cve/CVE-2026-105134\n#KEV #cybersecurity #infosec", "url": "https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3mxul3npzr72x"}, {"timestamp": "2026-10-15T03:57:03.605Z", "date_only": false, "value": "2026-10-15T03:57:03.605Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-105134", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T06:30:30.060Z", "date_only": false, "value": "2026-10-15T06:30:30.060772Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3mxvgrl4p2g2d", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "f06f9390-e2ad-46f5-8f8c-0f0d5527ca86", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-105134: \u26a0\ufe0f CVE-2026-105134: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 1.8%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-105134-a-flaw-has-been-found-in", "url": "https://bsky.app/profile/threatspotai.bsky.social/post/3mxvgrl4p2g2d"}, {"timestamp": "2026-10-15T08:00:15.955Z", "date_only": false, "value": "2026-10-15T08:00:15.955353Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/diesec.bsky.social/post/3mxvls2oylx2x", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "30722192-07a5-4f99-835a-077368fd738b", "content": "AhsayCBS backup servers are being exploited (CVE-2026-105134, CVSS 9.3). Ahsay confirmed 10.3.4.0 did not fix it; install hotfix 10.3.4.45 and restrict the console to trusted IPs or VPN. #AhsayCBS #CyberSecurity\n\ndiesec.com/2026/10/ahsa...\ndiesec.com/de/2026/10/a...", "url": "https://bsky.app/profile/diesec.bsky.social/post/3mxvls2oylx2x"}, {"timestamp": "2026-10-15T09:30:50.576Z", "date_only": false, "value": "2026-10-15T09:30:50.576633Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/yasna.io/post/3mxvqtzqbfb2l", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "7729096c-f062-4654-aa59-484700ed4a7e", "content": "AhsayCBS backup software flaws were exploited to deploy web shells and crypto miners, prompting new security fixes after incomplete patches.\n\nCVE-2026-105133, CVE-2026-105134 #Flaw #Vulnerability #infosec\n\nFull synthesis & sources: yasna.io", "url": "https://bsky.app/profile/yasna.io/post/3mxvqtzqbfb2l"}, {"timestamp": "2026-10-15T10:43:09Z", "date_only": false, "value": "2026-10-15T10:43:09.000000Z", "kind": "sighting", "label": "Exploited", "source": "Telegram/MY1DfKqlcmboS7F4ywdEe9Gq7pRiPxBgQxkohvdLCkrZ0Q", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "d476691b-bd2a-44a7-b196-c0e9893687a0", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-15T10:43:09Z", "date_only": false, "value": "2026-10-15T10:43:09.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/MY1DfKqlcmboS7F4ywdEe9Gq7pRiPxBgQxkohvdLCkrZ0Q", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "b6747ebd-a59d-40c3-9bbe-62ffcbbaedc2"}, {"timestamp": "2026-10-15T11:20:08.106Z", "date_only": false, "value": "2026-10-15T11:20:08.106314Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mxvwxidppb22", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "d96dc24b-9678-455a-90f2-878c4a83a1cf", "content": "Ahsay AhsayCBS: CISA confirms active exploitation of chained flaws CVE-2026-105133 auth bypass + CVE-2026-105134 command injection \u2014 admin takeover possible. No fixed version published yet; lock down the Replication Receiver endpoint now. https://cti.securitycyber.uk", "url": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mxvwxidppb22"}, {"timestamp": "2026-10-15T18:15:50.173Z", "date_only": false, "value": "2026-10-15T18:15:50.173564Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxwo6sifl22s", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "da36af3a-5f6e-4fd9-bfbd-ab3b1b461cb1", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-0322 \u00b7 30 people \ud83d\udd25\n2. CVE-2026-76519 \u00b7 30 people \ud83d\udd25\n3. CVE-2026-96951 \u00b7 11 people \ud83d\udd25\n4. CVE-2026-105133 \u00b7 10 people \ud83d\udd25\n5. CVE-2026-105134 \u00b7 8 people \ud83d\udd25\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxwo6sifl22s"}, {"timestamp": "2026-10-15T18:15:52.431Z", "date_only": false, "value": "2026-10-15T18:15:52.431943Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxwo6suo5k2s", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "d191a870-7140-4357-9e0d-854759ffa0e5", "content": "5. CVE-2026-105134 \u00b7 8 people \ud83d\udd25\n\ud83d\udfe5 Critical 10.0 \u00b7 AhsayCBS\n\nAhsay AhsayCBS Replication Receiver UpdateReceivers.do os command injection", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3mxwo6suo5k2s"}, {"timestamp": "2026-10-15T18:17:13.338Z", "date_only": false, "value": "2026-10-15T18:17:13.338778Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecybermind.co/post/3mxwobblzp42i", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "a6c40bff-3650-41c7-856a-1c711bc95c76", "content": "CVE-2026-105133 CVE-2026-105134 AhsayCBS Authentication Bypass and Command Injection: Technical Response & SOC Investigation\u00a0Brief https://thecybermind.co/z2es\n\nAhsayCBS authentication bypass and command injection require a coordinated response. This combined technical brief covers updated\u2026", "url": "https://bsky.app/profile/thecybermind.co/post/3mxwobblzp42i"}, {"timestamp": "2026-10-16T08:05:54.766Z", "date_only": false, "value": "2026-10-16T08:05:54.766264Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mxy4l2s6zrn5", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "de57aa58-01f6-472f-927a-7bfc52a43a0b", "content": "CISA KEV | CVE-2026-105134 | Ahsay / AhsayCBS\n\nCISA lists this vulnerability as exploited in the wild. Check affected products and vendor guidance.\n\nSource: CISA KEV\n\nFull analysis: https://t.me/aiutocomputerhelp_lab/1279", "url": "https://bsky.app/profile/aiuto-ch.bsky.social/post/3mxy4l2s6zrn5"}, {"timestamp": "2026-10-16T09:04:26.601Z", "date_only": false, "value": "2026-10-16T09:04:26.601485Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mxy7trfzuq2h", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "052aef4b-b930-4d9d-9792-afdfed5c35d5", "content": "AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches\n\nAhsay Backup has released security updates for two flaws in AhsayCBS, CVE-2026-105133 and CVE-2026-105134, that have been exploited to dr... https://threatintel.cc/2026/10/16/ahsaycbs-flaws-exploited-to-deploy.html", "url": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mxy7trfzuq2h"}, {"timestamp": "2026-10-16T09:04:26.742Z", "date_only": false, "value": "2026-10-16T09:04:26.742162Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117449783067164857", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "f42fc373-8d70-4dfe-9833-54594873d4a9", "content": "AhsayCBS Flaws Exploited to Deploy Web Shells Get New Fixes After Incomplete Patches\nAhsay Backup has released security updates for two flaws in AhsayCBS, CVE-2026-105133 and CVE-2026-105134, that have been exploited to drop web shells and XMRig cryptocurrency miners. The vulnerabilities could be chained to bypass authentication and execute arbitrary commands, and the new fixes follow earlier incomplete patches. https://thehackernews.com/2026/10/ahsaycbs-flaws-exploited-to-deploy-web.html", "url": "https://infosec.exchange/users/edwardk/statuses/117449783067164857"}, {"timestamp": "2026-10-16T16:15:13Z", "date_only": false, "value": "2026-10-16T16:15:13.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/HyJwhMarL5MfN14Ap2Hfx7di3K9_sKk0kry7Veh3xgnzykc", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "184438c8-4517-4468-9542-89495b078535", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-17T00:00:00Z", "date_only": true, "value": "2026-10-17", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-105134", "field": "evidence.0.details.due_date", "uuid": "5372a69c-88fe-4cff-b4f5-28de9b6c5f58", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-26T14:31:13.988Z", "date_only": false, "value": "2026-10-26T14:31:13.988Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-105134", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-26T14:31:13.988Z", "date_only": false, "value": "2026-10-26T14:31:13.988Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulDB", "record": "CVE-2026-105134", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-26T15:34:18Z", "date_only": false, "value": "2026-10-26T15:34:18Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-MXJ3-2X8Q-2RH9", "record": "GHSA-MXJ3-2X8Q-2RH9", "field": "modified"}, {"timestamp": "2026-10-26T15:35:59Z", "date_only": false, "value": "2026-10-26T15:35:59.000Z", "kind": "other", "label": "Time", "source": "cvelistv5 / VulDB", "record": "CVE-2026-105134", "field": "containers.cna.timeline.2.time"}, {"timestamp": "2026-10-26T18:06:57.930Z", "date_only": false, "value": "2026-10-26T18:06:57.930", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-105134", "record": "FKIE_CVE-2026-105134", "field": "lastModified"}, {"timestamp": "2026-10-27T02:04:45Z", "date_only": false, "value": "2026-10-27T02:04:45.000000Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-105134.yaml", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "fb04fd21-71c3-41ff-ad7c-91cd93478eef", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-105134.yaml"}, {"timestamp": "2026-11-01T18:15:12Z", "date_only": false, "value": "2026-11-01T18:15:12.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/Cgdocx/4236f885359c658cd177808b076b814f", "record": "cve-2026-105134", "field": "creation_timestamp", "uuid": "ff5629a5-5c1e-44ac-9c12-a090d2d0f21d", "content": "# AhsayCBS (CVE-2026-105133 / CVE-2026-105134) \u2014 Lab Verification & IR Note\n\n**Author:** Pongsathorn Parivutthipong \u00b7 **Date:** 2026-11-01 (UTC+7) \u00b7 **Scope:** defensive inventory / hunt / mitigation verification on an isolated lab host. No exploit traffic was sent; no PoC is included.\n\n## 1. Lab identity\n\n| Item | Value |\n|---|---|\n| Host | `dfir-lab` (isolated), Debian GNU/Linux 13 (trixie), Linux 6.12.94+ x86_64 |\n| AhsayCBS | **Not installed** on this lab host \u2014 inventory negative |\n| Lab scripts | `/lab/ahsaycbs/inventory.sh`, `/lab/ahsaycbs/hunt.sh`, `/lab/ahsaycbs/mitigation.sh` (read-only) |\n| sha256 inventory.sh | `a2be4bb305da109b64ddf22cd39aa1a727e490b8289f10240f2d691c2f3e8bb8` |\n| sha256 hunt.sh | `1371f76de1594e6aa89fbe554f198480a45108ec3a55fc85d00c8388a6711a60` |\n| sha256 mitigation.sh | `be5547080526a7462d0b0c69581418ba50c5d4f5358d45cacb10700118d375c0` |\n| Windows hunt commands | Documentation for authorized AhsayCBS Windows hosts only \u2014 not run on `dfir-lab` |\n\n## 2. Advisory tracker\n\n- **CVE-2026-105133** \u2014 Improper Authentication in the API (`checkSysPwd()`), allowing authentication bypass. CVSS v4.0 5.5 (per ThaiCERT).\n- **CVE-2026-105134** \u2014 OS Command Injection in the Replication Receiver component; public reports note SYSTEM-level execution. CVSS v4.0 9.3.\n- Chained, the two give an unauthenticated attacker command execution on the backup server.\n\n[Huntress](https://www.huntress.com/blog/ahsaycbs-flaws-exploit) observed in-the-wild exploitation from about 7 Oct 2026 23:20 UTC (8 Oct 2026, 06:20 UTC+7). Post-access activity consisted of JSP web shells under the CBS `webapps` tree and an XMRig miner disguised as Microsoft Edge, installed as a fake `MicrosoftEdgeUpdateSvc` service. [Ahsay](https://www.ahsay.com/en/company/announcements/ahsaycbs-vulnerability-status-update) published its hotfix / status update on 13 Oct 2026, and [ThaiCERT](https://www.thaicert.or.th/2026/10/20/\u0e41\u0e08\u0e49\u0e07\u0e40\u0e15\u0e37\u0e2d\u0e19-\u0e0a\u0e48\u0e2d\u0e07\u0e42\u0e2b\u0e27\u0e48-ahsaycbs-\u0e16\u0e39\u0e01/) issued a Thai-language alert on 20 Oct 2026. Both CVEs are listed in the [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog). The [Bitdefender technical advisory](https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-ahsaycbs-exploitation-chain-cve-2026-105133-cve-2026-105134) covers the exploitation chain in more detail.\n\nImportant: earlier builds (9.15.2.59 / 10.3.4.0) are **not** fully fixed \u2014 check the exact build, not only the major version.\n\n## 3. Hotfix matrix (source: Ahsay)\n\n| Branch | Action |\n|---|---|\n| v10 | Hotfix **10.3.4.45** |\n| v9 | Hotfix **9.15.2.70** |\n| v7 / v8 | Upgrade to **9.15.0.0**, then apply **9.15.2.70** |\n\nNote: a server restart is required after applying the hotfix (vendor requirement). On Windows, apply the hotfix with **Run as administrator**, then restart the AhsayCBS service / host. Confirm the build in the admin console afterwards \u2014 an applied-but-not-restarted server is still vulnerable.\n\n## 4. Lab inventory (negative) & reference output\n\nRead-only inventory check for `/opt/AhsayCBS` and the `CBS` env var on Linux. (On Windows CBS hosts the default install is `C:\\Program Files\\AhsayCBS`, or `%CBS%` if set \u2014 covered by the PowerShell in \u00a75.) The product is **not installed** on `dfir-lab`, so the output below is a negative inventory plus reference text, not a verified mitigation:\n\n```console\n$ bash /lab/ahsaycbs/inventory.sh\n=== inventory: AhsayCBS path check (defensive) ===\nSun, 01 Nov 2026 11:53:18 +0700\nhostname: dfir-lab\nuname: Linux 6.12.94+ x86_64\n\n# OS\nPRETTY_NAME=\"Debian GNU/Linux 13 (trixie)\"\nNAME=\"Debian GNU/Linux\"\nVERSION_ID=\"13\"\n\n# look for AhsayCBS install paths (read-only)\n# Windows: %CBS%   Linux: $CBS / /opt/AhsayCBS\nAhsayCBS path not present on this lab host (inventory negative)\n\n# Expected hotfix builds (Ahsay / ThaiCERT \u2014 not proof of local patch state)\nv10 -> Hotfix 10.3.4.45\nv9  -> Hotfix 9.15.2.70\nv7/v8 -> upgrade to 9.15.0.0 then 9.15.2.70\n# Windows: apply hotfix Run as administrator, then restart\n\ninventory done.\n```\n\nResult: no AhsayCBS install on the lab host. The hotfix list is printed for reference only \u2014 it does not prove local patch state. On a real CBS host, read the build from the admin console or install directory.\n\n\n\n## 5. Hunt commands used (copy-paste)\n\nWindows \u2014 services / processes / files (authorized CBS hosts only; **run elevated** in an Administrator PowerShell):\n\n```powershell\n# fake Edge Update service\nGet-Service -Name MicrosoftEdgeUpdateSvc -ErrorAction SilentlyContinue\nGet-CimInstance Win32_Service | Where-Object {\n  $_.Name -match 'MicrosoftEdgeUpdate|EdgeUpdateHelper' -or\n  $_.PathName -match '\\\\Temp\\\\.*(msedge|edge)\\.exe'\n} | Format-List Name, State, StartMode, PathName, StartName\n\n# Edge-named processes outside Microsoft's Edge folder\nGet-Process edge,msedge -ErrorAction SilentlyContinue |\n  Select-Object Id, ProcessName, Path, StartTime |\n  Where-Object { ($_.Path) -and ($_.Path -notmatch '\\\\Microsoft\\\\Edge') }\n\n# hash Temp artifacts against public IoCs\n# run elevated (Administrator) so SYSTEM temp folders are readable\n$tempDirs = @(\n  $env:TEMP, \"$env:LOCALAPPDATA\\Temp\",\n  'C:\\Windows\\Temp',\n  'C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Temp'\n) | Where-Object { $_ } | Select-Object -Unique\n$targets = foreach ($d in $tempDirs) {\n  foreach ($n in 'edge.exe','msedge.exe','Taskgmr.ps1') { Join-Path $d $n }\n}\n$ioc = @{\n  '4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d'='edge.exe'\n  '05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034'='msedge.exe'\n  '481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21'='Taskgmr.ps1'\n}\nforeach ($f in $targets) {\n  if (Test-Path -Path ${f}) {\n    $h = (Get-FileHash -Path ${f} -Algorithm SHA256).Hash.ToLower()\n    [pscustomobject]@{Path = ${f}; SHA256 = $h; Match = $ioc.ContainsKey($h)}\n  }\n}\n```\n\nWindows \u2014 network / children of the AhsayCBS service:\n\n```powershell\n# established connections to mining pool port 8029\nGet-NetTCPConnection -State Established -ErrorAction SilentlyContinue |\n  Where-Object { $_.RemotePort -eq 8029 } |\n  Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,OwningProcess\n\n# child processes of cbssvc* (web shell commands surface here)\nGet-CimInstance Win32_Process | Where-Object {\n  $_.ParentProcessId -in (\n    (Get-Process cbssvcX64,cbssvcX86 -ErrorAction SilentlyContinue).Id\n  )\n} | Select-Object ProcessId, Name, CommandLine, ParentProcessId\n\n# recently created JSP files under the CBS webapps tree\n# do not rely on $env:CBS alone \u2014 fall back to the default install path\n$cbs = if ($env:CBS) { $env:CBS } else { 'C:\\Program Files\\AhsayCBS' }\n$web = Join-Path $cbs 'webapps'\nif (-not (Test-Path $web)) { Write-Warning \"webapps not found at $web - set the CBS path manually\" }\nGet-ChildItem $web -Recurse -Filter *.jsp -ErrorAction Stop |\n  Where-Object { $_.CreationTime -gt (Get-Date '2026-10-07') } |\n  Select-Object FullName, CreationTime, Length\n```\n\nPublic IoCs (Huntress):\n\n| Artifact | SHA-256 |\n|---|---|\n| `edge.exe` (XMRig) | `4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d` |\n| `msedge.exe` (modified NSSM) | `05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034` |\n| `Taskgmr.ps1` | `481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21` |\n\n- Service: `MicrosoftEdgeUpdateSvc` (genuine Edge uses `edgeupdate` / `edgeupdatem`)\n- Staging bucket: `imagefiles-backup.oss-ap-southeast-7.aliyuncs[.]com` \u2014 block this bucket only, not all of `aliyuncs.com`\n- Pool: `xmr.kryptex[.]network:8029` / `51.195.127[.]124:8029`\n- Files: `edge.exe` / `msedge.exe` / `config.json` in Temp, `WinRing0x64.sys`, unknown `*.jsp` under `%CBS%\\webapps`\n- Vendor cues: odd root folders (`ahsay_ts`, `ahsay_t8`\u2026), unauthorized Replication Receivers / Admin accounts\n\nOutput on `dfir-lab` (quiet, as expected \u2014 no AhsayCBS present, cue lookup only):\n\n```console\n$ bash /lab/ahsaycbs/hunt.sh\n=== hunt: public IoC cues (lookup only) ===\nSun, 01 Nov 2026 11:53:18 +0700\ndfir-lab\n\n# SHA-256 (public: Huntress)\nedge.exe_XMRig\n  4dcb0202fe8b2d4d7b183764e38184cd6ed50132786cc7e7d1f7f4bce1dd6f3d\nmsedge.exe_NSSM\n  05f69ae6b2b89c1c4dcf836bff032232f11bf0109f2b498e2345045d06139034\nTaskgmr.ps1\n  481728a7c9c4c02be07051d9c1958d902ea6397ebb8952ab83944818e3d25d21\n\n# service / filename / network hunt cues (names only)\nMicrosoftEdgeUpdateSvc\nedge.exe in %TEMP%\nmsedge.exe in %TEMP%\nunknown *.jsp under %CBS%\\webapps\noutbound TCP 8029 -> xmr.kryptex.network\nimagefiles-backup.oss-ap-southeast-7.aliyuncs.com (bucket only)\n\nhunt done \u2014 if matches on authorized Windows CBS host: isolate + preserve evidence.\n```\n\n\n\nMitigation checklist (exact lab output of `mitigation.sh`; sha256 in \u00a71):\n\n```console\n$ bash /lab/ahsaycbs/mitigation.sh\n=== mitigation checklist (documentation) ===\nSun, 01 Nov 2026 11:53:18 +0700\n[ ] Apply Hotfix 10.3.4.45 (v10) or 9.15.2.70 (v9); restart server\n[ ] Restrict AhsayCBS admin UI to VPN / allowlisted IPs (no direct Internet)\n[ ] Review %CBS%\\webapps for unexpected .jsp / random folders\n[ ] Review unauthorized RPS receivers and Admin accounts\n[ ] Hunt MicrosoftEdgeUpdateSvc / edge.exe / Taskgmr.ps1\n[ ] Block imagefiles-backup.oss-ap-southeast-7.aliyuncs.com (bucket only)\n[ ] Alert on outbound TCP/8029 to xmr.kryptex.network\n[ ] If IoCs found: isolate -> preserve evidence -> rotate creds\n[ ] rebuild host (OS + CBS + hotfix), restore AutoSave from >= 1 day before compromise\n\nmitigation checklist ready.\n```\n\nExpanded recovery steps (credential rotation, AutoSave restore window) are in \u00a77; they are guidance, not script output.\n\n\n\n\n## 6. Detection ideas\n\nNote: the logic below is PowerShell / WMI for **Windows targets**, because in-the-wild cases place the fake Edge binaries and service on Windows CBS servers. On Linux hosts (including this `dfir-lab` box) use the equivalents: `auditd` execve rules, `ps -eo pid,ppid,cmd`, `ss -tnp`, and bash scripts.\n\n- Unexpected child processes of `cbssvcX64` / `cbssvcX86` (`Get-CimInstance Win32_Process` by ParentProcessId)\n- Edge-named binaries outside Microsoft's Edge folder (`Get-Process edge,msedge` path check)\n- Fake service lookup (`Get-Service MicrosoftEdgeUpdateSvc`, `Win32_Service` PathName in Temp)\n- Hash compare of Temp artifacts (`Get-FileHash`) against the IoC table\n- Established connections on port 8029 (`Get-NetTCPConnection`)\n- Huntress Sigma rules: Unexpected Child Process from AhsayCBS \u00b7 Fake Edge Binary \u00b7 Task Manager Aware Service Control \u00b7 WinRing0 via cmdline\n\nSigma-style sketch (align with the Huntress rule set):\n\n```yaml\ntitle: Suspicious child process of AhsayCBS service\nlogsource:\n  category: process_creation\n  product: windows\ndetection:\n  parent:\n    ParentImage|endswith:\n      - '\\cbssvcX64.exe'\n      - '\\cbssvcX86.exe'\n  child:\n    Image|endswith:\n      - '\\cmd.exe'\n      - '\\powershell.exe'\n      - '\\certutil.exe'\n      - '\\curl.exe'\n  fake_edge:\n    Image|endswith:\n      - '\\edge.exe'\n      - '\\msedge.exe'\n    Image|contains: '\\Temp\\'\n  condition: (parent and child) or fake_edge\nlevel: high\n```\n\nExpect some false positives from legitimate CBS maintenance scripts \u2014 baseline first.\n\n## 7. Evidence & recovery policy\n\n- **Do NOT reproduce the exploit or run any PoC.** Work only with artifacts that already exist.\n- Isolate the suspected backup server from the network; **do not reboot before evidence is collected** \u2014 a reboot destroys memory and live network state.\n- Preserve: disk image, or at minimum `%CBS%\\webapps`, relevant Temp folders, Evtx logs, service list, `netstat` output, and memory if possible.\n- Hash every artifact (SHA-256) and record chain of custody.\n- Remove the fake service / kill miner processes only **after** evidence is collected.\n- Rotate credentials: CBS admin, Replication (RPS) accounts, OS accounts.\n- Recover per Ahsay: rebuild host (OS, CBS, and hotfix), then restore AutoSave from >= 1 day before compromise.\n- Huntress recommends re-imaging from a trusted backup when IoCs are found, since hidden backdoors may remain. Verify backup-set integrity before reuse.\n\n## 8. 24h ops checklist\n\n1. Inventory every AhsayCBS install (v7\u2013v10); record exact build and Internet exposure.\n2. Apply hotfix 10.3.4.45 / 9.15.2.70 (Run as administrator on Windows) and restart.\n3. Restrict the admin UI to VPN / allowlisted IPs; review Replication Receivers and Admin accounts.\n4. Run the hunt commands in \u00a75; compare Temp hashes against the IoC table.\n5. Block the OSS staging bucket and alert/block outbound TCP 8029 to the pool.\n6. Enable the detections in \u00a76 (Huntress Sigma / EDR); review hits after 24h.\n7. Check `%CBS%\\webapps` (or `C:\\Program Files\\AhsayCBS\\webapps`) for JSP files created since 7 Oct 2026 and confirm no odd root folders (`ahsay_ts`, `ahsay_t8`).\n8. If IoCs are found: isolate, preserve evidence, report to ThaiCERT if in Thailand, and rebuild per \u00a77.\n\n## 9. References\n\n- [ThaiCERT alert (20 Oct 2026)](https://www.thaicert.or.th/2026/10/20/\u0e41\u0e08\u0e49\u0e07\u0e40\u0e15\u0e37\u0e2d\u0e19-\u0e0a\u0e48\u0e2d\u0e07\u0e42\u0e2b\u0e27\u0e48-ahsaycbs-\u0e16\u0e39\u0e01/)\n- [Huntress \u2014 AhsayCBS flaws exploited](https://www.huntress.com/blog/ahsaycbs-flaws-exploit)\n- [Ahsay \u2014 vulnerability status update](https://www.ahsay.com/en/company/announcements/ahsaycbs-vulnerability-status-update)\n- [Bitdefender technical advisory](https://www.bitdefender.com/en-us/blog/businessinsights/technical-advisory-ahsaycbs-exploitation-chain-cve-2026-105133-cve-2026-105134)\n- [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)\n\n## Disclaimer\n\nDefensive lab note. Inventory/hunt blocks are read-only checks or logging rules. Mitigation and recovery steps (hotfix, service removal, process kill, rebuild) change a production backup server \u2014 run only on authorized systems after evidence collection. No exploitation steps, payloads or proof-of-concept are provided or were run.\n", "url": "https://gist.github.com/Cgdocx/4236f885359c658cd177808b076b814f"}], "metrics": {"as_of": "2026-11-02T01:00:14.948Z", "anchors": {"origin": {"timestamp": "2026-10-04T05:30:12.882Z", "date_only": false, "value": "2026-10-04T05:30:12.882Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-105134", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-04T05:30:12.882Z", "date_only": false, "value": "2026-10-04T05:30:12.882Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-105134", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-10-05T15:00:22Z", "date_only": false, "value": "2026-10-05T15:00:22.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/zC7t4Lx05uyfmCVlTGAKrLAcTODowFQbx3kd_6HhY1YAH_E", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "e1e18de8-a43d-412e-a07c-4bca2ab77b44", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2026-10-09T09:54:00Z", "date_only": false, "value": "2026-10-09T09:54:00+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-105134", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "ee51c36a-4e8a-4563-8754-ae5f29e4f74b", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 447827.118, "hours": 124.39642166666667, "days": 5.183184236111111, "min_seconds": 447827.118, "max_seconds": 447827.118, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-04T05:30:12.882Z", "date_only": false, "value": "2026-10-04T05:30:12.882Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-105134", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-09T09:54:00Z", "date_only": false, "value": "2026-10-09T09:54:00+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-105134", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "ee51c36a-4e8a-4563-8754-ae5f29e4f74b", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": 447827.118, "hours": 124.39642166666667, "days": 5.183184236111111, "min_seconds": 447827.118, "max_seconds": 447827.118, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-04T05:30:12.882Z", "date_only": false, "value": "2026-10-04T05:30:12.882Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-105134", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-09T09:54:00Z", "date_only": false, "value": "2026-10-09T09:54:00+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-105134", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "ee51c36a-4e8a-4563-8754-ae5f29e4f74b", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 120609.118, "hours": 33.50253277777778, "days": 1.3959388657407408, "min_seconds": 120609.118, "max_seconds": 120609.118, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-04T05:30:12.882Z", "date_only": false, "value": "2026-10-04T05:30:12.882Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-105134", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-05T15:00:22Z", "date_only": false, "value": "2026-10-05T15:00:22.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/zC7t4Lx05uyfmCVlTGAKrLAcTODowFQbx3kd_6HhY1YAH_E", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "e1e18de8-a43d-412e-a07c-4bca2ab77b44", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 2489402.066925, "hours": 691.5005741458333, "days": 28.812523922743054, "min_seconds": 2489402.066925, "max_seconds": 2489402.066925, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-04T05:30:12.882Z", "date_only": false, "value": "2026-10-04T05:30:12.882Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-105134", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-02T01:00:14.948Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 2041574.948925, "hours": 567.1041524791666, "days": 23.629339686631944, "min_seconds": 2041574.948925, "max_seconds": 2041574.948925, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-09T09:54:00Z", "date_only": false, "value": "2026-10-09T09:54:00+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-105134", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "ee51c36a-4e8a-4563-8754-ae5f29e4f74b", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2026-11-02T01:00:14.948Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 2368792.948925, "hours": 657.9980413680556, "days": 27.416585057002315, "min_seconds": 2368792.948925, "max_seconds": 2368792.948925, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-05T15:00:22Z", "date_only": false, "value": "2026-10-05T15:00:22.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/zC7t4Lx05uyfmCVlTGAKrLAcTODowFQbx3kd_6HhY1YAH_E", "record": "CVE-2026-105134", "field": "creation_timestamp", "uuid": "e1e18de8-a43d-412e-a07c-4bca2ab77b44", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-02T01:00:14.948Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}