2026-10-09: Threat actors are exploiting AhsayCBS backup server flaws (CVE-2026-105133 and CVE-2026-105134) for

Show Notes - 2026-10-09

Stories Covered: - Today: - Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer (CVE-2026-105133, CVE-2026-105134) (https://www.huntress.com/blog/ahsaycbs-flaws-exploit) - MonsterCloud Owner Charged with Defrauding Ransomware Victims (https://www.theregister.com/cyber-crime/2026/10/08/ransomware-fixer-claimed-he-could-decrypt-files-allegedly-defrauded-clients-instead/5301831) - Small Construction Firm Fails After Ransomware; Second Firm Stops AiTM Phishing (https://www.theregister.com/security/2026/10/08/cheapskates-wouldnt-pay-for-security-help-got-hit-by-ransomware-and-went-bust-months-later/5301757) - CISA and Partners: Chinese Government-linked Actors Combine Automated and Hands-on Tools (AA26-281A) (https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-281a) - Reward Offered for HAFNIUM Suspect Zhang Yu (https://thehackernews.com/2026/10/us-offers-up-to-10-million-for-tips-on.html) - Let's Encrypt Cuts Certificate Lifetimes to 64 Days (https://arstechnica.com/gadgets/2026/10/lets-encrypt-cuts-certificate-lifetimes-to-64-days-starting-february-2027/) - Tensorlake npm Package Compromised with Shai-Hulud Worm (https://thehackernews.com/2026/10/tensorlake-npm-package-compromised-to.html) - Other Items (https://thehackernews.com/2026/10/artex-ai-pentesting-tool-used-in-data.html) - Microsoft Cloud CVEs (MSRC) (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-77900) - Red Lion N-Tron 700 Series (ICSA-26-281-01) (https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01) - Grid Protection Alliance openPDC and openHistorian (ICSA-26-281-02) (https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-02) - Other advisories (https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-03)

CVEs Referenced: CVE-2025-11215, CVE-2026-100730, CVE-2026-101022, CVE-2026-104629, CVE-2026-105133, CVE-2026-105134, CVE-2026-105278, CVE-2026-105281, CVE-2026-28745, CVE-2026-29797, CVE-2026-32645, CVE-2026-33272, CVE-2026-33367, CVE-2026-39453, CVE-2026-39460, CVE-2026-47483, CVE-2026-69435, CVE-2026-77900, CVE-2026-83943, CVE-2026-83947, CVE-2026-85479, CVE-2026-88131

Indicators of Compromise: Domains: aliyuncs[.]com, 127[.]124, kryptex[.]network IPs: 2.0.6.1

Full brief: https://carolinacleartech.com/brief/2026-10-09/